CVE-2025-22049: linux kernel — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Increase ARCH_DMA_MINALIGN up to 16 ARCH_DMA_MINALIGN is 1 by default, but some LoongArch-specific devices (such as APBDMA) require 16 bytes alignment. When the data buffer length is too small, the hardware may make an error writing cacheline. Thus, it is dangerous to allocate a small memory buffer for DMA. It's always safe to define ARCH_DMA_MINALIGN as L1_CACHE_BYTES but unnecessary (kmalloc() need small memory objects). Therefore, just increase it to 16.

Is your site exposed to CVE-2025-22049?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
linux	linux_kernel	5.19 — 6.1.134
linux	linux_kernel	6.2 — 6.6.87
linux	linux_kernel	6.7 — 6.12.23
linux	linux_kernel	6.13 — 6.13.11
linux	linux_kernel	6.14 — 6.14.2

References

Advisories & Patches

https://git.kernel.org/stable/c/1d0def2d1658666ec1f32c9495df60e7411e3c82 https://git.kernel.org/stable/c/279ec25c2df49fba1cd9488f2ddd045d9cb2112e https://git.kernel.org/stable/c/4103cfe9dcb88010ae4911d3ff417457d1b6a720 https://git.kernel.org/stable/c/8b82aea3666f8f2c78f86148d78aea99c46e0f82 https://git.kernel.org/stable/c/bfff341cac7c650e6ca8d10503725992f5564d0f https://git.kernel.org/stable/c/f39af67f03b564b763b06e44cb960c10a382d54a

Other References

https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Frequently Asked Questions

What is CVE-2025-22049? +

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Increase ARCH_DMA_MINALIGN up to 16 ARCH_DMA_MINALIGN is 1 by default, but some LoongArch-specific devices (such as APBDMA) require 16 bytes alignment. When the data buffer length is too small, the hardware may make an error writing cacheline. Thus, it is dangerous to allocate a small memory buffer for DMA. It's always safe to define ARCH_DMA_MINALIGN as L1_CACHE_BYTES but unnecessary (kmalloc() need small memory objects). Therefore, just increase it to 16. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-22049? +

CVE-2025-22049 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-22049? +

CVE-2025-22049 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-22049? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-9588 10.0

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. …

CVE-2025-57870 10.0

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This …

CVE-2026-48286 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2026-89275 10.0

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result …

CVE-2026-75723 10.0

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the …

CVE-2026-75721 10.0