Skip to main content

Linux CVE-2025-38408

MEDIUM
NULL Pointer Dereference (CWE-476)
2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
4.1 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 17, 2026 - 20:45 vuln.today
Patch released
Mar 17, 2026 - 20:45 nvd
Patch available
CVE Published
Jul 25, 2025 - 14:15 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

genirq/irq_sim: Initialize work context pointers properly

Initialize ops member's pointers properly by using kzalloc() instead of kmalloc() when allocating the simulation work context. Otherwise the pointers contain random content leading to invalid dereferencing.

AnalysisAI

A null pointer dereference vulnerability exists in the Linux kernel's interrupt simulation (genirq/irq_sim) subsystem where uninitialized pointers in the work context can be dereferenced, leading to kernel denial of service. The vulnerability affects Linux kernel versions including 6.16-rc1 and 6.16-rc2, and potentially earlier stable releases. A local attacker with unprivileged user privileges can trigger a kernel crash by invoking interrupt simulation functionality, causing system unavailability. Patches are available from the Linux kernel stable repositories, and exploitation probability is low (EPSS 0.02%, percentile 6%) despite the moderate CVSS score of 5.5.

Technical ContextAI

The vulnerability resides in the generic interrupt request (genirq) simulation framework within the Linux kernel, specifically in the irq_sim subsystem used for testing and simulating interrupt handlers. The root cause is classified under CWE-476 (Null Pointer Dereference), which occurs because the code allocates memory for the simulation work context using kmalloc() instead of kzalloc(). The kmalloc() function returns uninitialized memory containing arbitrary data, while kzalloc() allocates zeroed memory. When the ops member (containing function pointers) within this context is not zeroed, subsequent code attempts to dereference these invalid pointers, triggering a null pointer exception or wild pointer dereference. Affected Linux kernel versions span multiple stable branches (CPE cpe:2.3:o:linux:linux_kernel with versions 6.16-rc1, 6.16-rc2, and potentially earlier stable kernels), impacting any system with interrupt simulation capabilities compiled into the kernel.

RemediationAI

Apply the available kernel patches immediately by updating to a patched stable kernel version. Six commits are available in the Linux kernel stable repositories: commit 186df821de0f34490ed5fc0861243748b2483861, 19bd7597858dd15802c1d99fcc38e528f469080a, 7f73d1def72532bac4d55ea8838f457a6bed955c, 8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819, c71aa4bb528ae6f8fd7577a0a39e5a03c60b04fb, and ec3656a8cb428d763def32bc2fa695f94be23629 (see https://git.kernel.org/stable/ for access). The fix is straightforward: rebuild and deploy a kernel version containing these patches, or selectively backport the genirq/irq_sim initialization fix (changing kmalloc to kzalloc in the work context allocation). For systems that cannot immediately patch, disable interrupt simulation support in the kernel configuration (unset CONFIG_IRQ_SIM) if the functionality is not required, and restrict unprivileged user access to interrupt simulation interfaces via SELinux, AppArmor, or seccomp rules if supported by the distribution.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.57 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.40 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.80 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.41 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.34 Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-GCE Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-GCE Affected

Share

CVE-2025-38408 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy