CVE-2025-38651
BaseFortify
Publication date: 2025-08-22
Last updated on: 2025-11-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability causes warnings during kernel unit testing due to improper handling of a zero value where a positive value was expected. While it does not describe a direct security exploit or system compromise, such warnings could indicate potential instability or unexpected behavior in the landlock security module if left unaddressed. Fixing this ensures more reliable and stable kernel behavior.
Can you explain this vulnerability to me?
This vulnerability is related to the Linux kernel's landlock security module. The issue was that the function get_id_range() expected a positive value as its first argument, but the function get_random_u8() could return 0, which is not positive. This mismatch caused warnings during KUnit tests. The fix involved clamping the value to ensure it is positive, preventing the warning and potential issues in the code execution.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to a warning in the Linux kernel's landlock security module during KUnit tests, specifically involving get_id_range() and get_random_u8(). Detection would involve checking kernel logs for warnings or errors related to landlock and the specific test_range2_rand16 warning. You can use the command 'dmesg | grep landlock' or 'journalctl -k | grep landlock' to look for such warnings in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed by clamping the value returned by get_random_u8() to ensure it is positive as expected by get_id_range(). Immediate mitigation involves updating the Linux kernel to a version that includes this fix. There are no other specific mitigation steps mentioned.