Linux Kernel
CVE-2025-38359
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated local access on s390 guest
-
DeliveryIssue user-space access in atomic context
-
ExploitFault on non-exported secure-storage page
-
ExecutionKernel sleeps while preemption disabled
-
ImpactDenial of service / instability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Proper locking
|
| Exploitation Conditions | Requires the IBM s390/s390x architecture running with Secure Execution / Protected Virtualization so that secure (non-exported) storage pages exist, plus a local authenticated user able to trigger a user-space memory access that faults while in atomic context (preemption disabled), such as a buffered write through copy_page_from_iter_atomic. Limiting factors: local access only (AV:L), requires an existing low-privileged account (PR:L), no remote vector, no user interaction by a third party, and the flaw manifests only on s390 hosts using secure storage - it does not affect other architectures or default non-secure-execution deployments. Impact is confined to availability; there is no confidentiality or integrity effect. |
| Impact | This is a medium-severity (CVSS 5.5) Linux kernel locking defect (CWE-667) on the IBM s390 architecture, and the signals point to a low real-world priority. The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a locally-triggered, authenticated (PR:L) availability-only issue with no confidentiality or integrity impact - consistent with a kernel 'sleeping function called from invalid context' BUG/potential crash rather than a data-exposure or code-execution flaw. No EPSS probability, CISA KEV entry, or POC indicator was supplied in the input, so there is no evidence of active exploitation or weaponization. Note a conflict in the metadata: the 'Information Disclosure' tag contradicts the CVSS vector, which explicitly sets C:N/I:N and A:H - the actual impact is availability (denial of service), not disclosure; defenders should disregard the disclosure framing. Exploitation is further constrained to s390 systems exercising the secure-storage-access path (Protected Virtualization / Secure Execution), narrowing the realistic attack surface considerably beyond what a raw score implies. |
| Exploit ScenarioDerived | A local, authenticated user on an IBM s390 host running a Secure Execution / Protected Virtualization guest performs an ordinary user-space memory access (e.g., a buffered file write via copy_page_from_iter_atomic) that faults on a non-exported secure-storage page while preemption is disabled (atomic context). The kernel incorrectly attempts to take mmap_lock and resolve the fault in atomic context, producing a sleeping-in-atomic violation that can destabilize or crash the system. No public exploit identified at time of analysis; impact is denial of service only. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local availability disruption affects Linux kernel s390/s390x deployments that use Secure Execution or Protected Virtualization. A user-space access to a non-exported secure page that faults in atomic context can drive do_secure_storage_access() to take mmap_lock while sleeping is not permitted, producing debug diagnostics and potential availability loss; the assessed CVSS vector requires a local low-privileged account and limits impact to availability. Vendor patches are available as upstream stable commits, and no public exploit code or CISA KEV entry was identified at time of analysis.
RemediationAI
Vendor-released patch: apply the upstream stable kernel update containing commits 11709abccf93b08adde95ef313c300b0d4bc28f1, 7aee3e5163cade3f4cf1cc0710dfbadb47f1ba84, 9bcfbd58fc5a02777fed3e582f22503ef3289a43, or d2e317dfd2d1fe416c77315d17c5d57dbe374915, and install the corresponding distribution kernel package. Until the update is deployed, restrict local interactive access on affected s390/s390x guests to trusted users and avoid running untrusted workloads that issue buffered writes to secure-storage-backed files; disabling Secure Execution/Protected Virtualization eliminates the secure-page fault condition but forfeits the isolation feature and is not a like-for-like mitigation. Monitor for 'sleeping function called from invalid context' traces in do_secure_storage_access as an indicator that an unpatched guest is being exercised.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is in the Linux kernel's s390 memory-management secure-storage fault path. IBM Secure Execution/Protected Virtualization marks certain guest pages as non-exported/secure; when user-space tries to access such a page and the access faults, do_secure_storage_access() may be invoked from an atomic context, for example during a buffered write through copy_page_from_iter_atomic() with preemption disabled. The handler attempted to resolve the fault, which requires mmap_lock, but sleeping locks cannot be acquired in atomic context, matching CWE-667 improper locking. The upstream fix treats the fault as an unmapped-page condition, returns -EFAULT to the uaccess caller, and lets process context retry and export the page. CPE data identifies linux_kernel as the affected product; exposure is architecture- and configuration-specific to s390/s390x with secure storage.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Triggered locally by an unprivileged local user's own memory access (AV:L, PR:L), no interaction needed; kernel instability yields A:H with no C/I impact.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
s390/mm: Fix in_atomic() handling in do_secure_storage_access()
Kernel user spaces accesses to not exported pages in atomic context incorrectly try to resolve the page fault. With debug options enabled call traces like this can be seen:
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [<00000383ea47cfa2>] copy_page_from_iter_atomic+0xa2/0x8a0 CPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39 Tainted: G W 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT Tainted: [W]=WARN Hardware name: IBM 3931 A01 703 (LPAR) Call Trace: [<00000383e990d282>] dump_stack_lvl+0xa2/0xe8 [<00000383e99bf152>] __might_resched+0x292/0x2d0 [<00000383eaa7c374>] down_read+0x34/0x2d0 [<00000383e99432f8>] do_secure_storage_access+0x108/0x360 [<00000383eaa724b0>] __do_pgm_check+0x130/0x220 [<00000383eaa842e4>] pgm_check_handler+0x114/0x160 [<00000383ea47d028>] copy_page_from_iter_atomic+0x128/0x8a0 ([<00000383ea47d016>] copy_page_from_iter_atomic+0x116/0x8a0) [<00000383e9c45eae>] generic_perform_write+0x16e/0x310 [<00000383e9eb87f4>] ext4_buffered_write_iter+0x84/0x160 [<00000383e9da0de4>] vfs_write+0x1c4/0x460 [<00000383e9da123c>] ksys_write+0x7c/0x100 [<00000383eaa7284e>] __do_syscall+0x15e/0x280 [<00000383eaa8417e>] system_call+0x6e/0x90 INFO: lockdep is turned off.
It is not allowed to take the mmap_lock while in atomic context. Therefore handle such a secure storage access fault as if the accessed page is not mapped: the uaccess function will return -EFAULT, and the caller has to deal with this. Usually this means that the access is retried in process context, which allows to resolve the page fault (or in this case export the page).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB