CVE-2025-38359
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-11-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves improper handling of page faults during secure storage access in atomic context on s390 architecture. Specifically, kernel user space accesses to non-exported pages in atomic context incorrectly try to resolve the page fault by taking the mmap_lock, which is not allowed. This causes kernel errors such as sleeping functions being called from invalid contexts. The fix ensures that such faults are handled by returning an error (-EFAULT) instead of trying to resolve the fault in atomic context, requiring the access to be retried in process context where it can be properly handled.
How can this vulnerability impact me? :
This vulnerability can cause kernel instability or crashes due to invalid attempts to resolve page faults in atomic context, which can lead to system errors or unexpected behavior, especially on s390 systems running the affected Linux kernel versions. It may affect applications or virtual machines (e.g., qemu-system-s39) that trigger these conditions, potentially impacting system reliability and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for specific call traces and BUG messages related to in_atomic() handling in do_secure_storage_access(). Look for messages such as 'BUG: sleeping function called from invalid context' and call traces involving copy_page_from_iter_atomic and do_secure_storage_access. You can use commands like 'dmesg | grep -i "BUG: sleeping function called from invalid context"' or 'journalctl -k | grep -i do_secure_storage_access' to find relevant kernel log entries.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to update the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by correcting the in_atomic() handling in do_secure_storage_access(). Until then, avoid running workloads that trigger secure storage access in atomic context, and enable debug options to monitor for related kernel warnings to detect potential exploitation attempts.