CVE-2025-38332

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Use memcpy() for BIOS version

The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is passed in.

Anyway, instead of memset() with 0 followed by a strlcat(), just use memcpy() and ensure that the resulting buffer is NULL terminated.

BIOSVersion is only used for the lpfc_printf_log() which expects a properly terminated string.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because triggering the condition requires local access or hardware initialization sequences on systems equipped with Emulex LightPulse Fibre Channel adapters. The issue causes fortify-source checks to induce a kernel panic during string handling of adapter BIOS versions. Environments that do not use this specific storage hardware or do not load the lpfc driver remain unaffected, limiting the overall blast radius across enterprise deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.