CVE-2025-38320
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-11-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.6.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stack-out-of-bounds read in the Linux kernel function regs_get_kernel_stack_nth() on the arm64 architecture. It occurs when the kernel attempts to read memory beyond the bounds of the stack, which is detected by KASAN (Kernel Address Sanitizer). The issue is related to how some gcc compilers handle this code and was previously fixed on the s390 architecture. The fix involves using a helper function READ_ONCE_NOCHECK() to safely read the stack memory without triggering false positives from KASAN.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to read memory outside the intended stack boundaries, which may lead to system instability, crashes, or potential information disclosure. Since it involves kernel memory, exploitation could affect system reliability or security, depending on the context in which the vulnerable function is used.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for KASAN (Kernel Address Sanitizer) reports indicating a stack-out-of-bounds read in regs_get_kernel_stack_nth(). You can check the kernel log messages using the command: dmesg | grep 'kasan: stack-out-of-bounds in regs_get_kernel_stack_nth'. This will help identify if the issue has been triggered on your system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the vulnerability is fixed, as the issue was resolved by using the READ_ONCE_NOCHECK() helper in regs_get_kernel_stack_nth() to prevent false positives from KASAN. Until an update is applied, monitoring for KASAN reports and avoiding running untrusted code that may trigger this bug is advisable.