CVE-2025-38434
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves a change in the Linux kernel where TASK_SIZE_MAX was set to LONG_MAX to optimize the access_ok() function. The assumption was that all user addresses are less than LONG_MAX and kernel addresses are greater, so access_ok() would filter kernel addresses correctly. However, addresses between TASK_SIZE and LONG_MAX, which are not valid user addresses, were incorrectly allowed by access_ok(). This caused issues because functions like get_user_pages_fast() accepted these invalid addresses, potentially leading to incorrect behavior or security problems. The fix was to revert the change and set TASK_SIZE_MAX back to TASK_SIZE to ensure correctness, even though it reduces performance.
How can this vulnerability impact me? :
The vulnerability can lead to improper validation of memory addresses in the Linux kernel, allowing certain invalid addresses to be accepted by functions like get_user_pages_fast(). This could result in security issues such as unauthorized access to kernel memory or instability in kernel operations that rely on correct address validation.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is mitigated by reverting the commit that changed TASK_SIZE_MAX to LONG_MAX back to TASK_SIZE. Therefore, the immediate step is to update your Linux kernel to a version where this revert has been applied, ensuring TASK_SIZE_MAX is set to TASK_SIZE. This may involve applying the patch that reverts commit ad5643cf2f69 or upgrading to a kernel version released after 2025-07-25 that includes this fix.