CVE-2025-38649
BaseFortify
Publication date: 2025-08-22
Last updated on: 2025-11-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an infinite loop in the Linux kernel's Coresight device handling on the arm64 architecture for the qcom qcs615 platform. When only a source device is enabled, the function coresight_find_activated_sysfs_sink recursively calls itself trying to find an active sink device, causing a stack overflow and system crash. The fix disables replicator1 to break this infinite loop and prevent the crash.
How can this vulnerability impact me? :
This vulnerability can cause the system to crash due to a stack overflow triggered by an infinite loop in the Coresight device handling. This can lead to denial of service or instability on affected devices running the vulnerable Linux kernel on the specified platform.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, disable the replicator1 device to break the infinite loop and prevent a potential stack overflow and system crash. This change ensures that only trace data originating from AOSS can reach the ETF_SWAO and EUD sinks, avoiding the problematic recursive calls.