CVE-2025-38132

In the Linux kernel, the following vulnerability has been resolved: coresight: holding cscfg_csdev_lock while removing cscfg from csdev There'll be possible race scenario for coresight config: CPU0 CPU1 (perf enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) deactivate config // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() <iterating config_csdev_list> cscfg_remove_owned_csdev_configs() // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock) iterating config_csdev_list could be raced with config_csdev_list's entry delete. To resolve this race , hold csdev->cscfg_csdev_lock() while cscfg_remove_owned_csdev_configs()

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/18a3a21c39cca593762aa90f322bd74c18ec59d4
https://git.kernel.org/stable/c/1cd09aaf47a570bf6b05a7cd06b98e9d35fe82c7
https://git.kernel.org/stable/c/42f8afb0b161631fd1d814d017f75f955475ad41	Patch
https://git.kernel.org/stable/c/53b9e2659719b04f5ba7593f2af0f2335f75e94a	Patch
https://git.kernel.org/stable/c/8f16b9caf0bdba46044e1d3727ee78291aa36347

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

History

30 Oct 2026, 13:18

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/18a3a21c39cca593762aa90f322bd74c18ec59d4 -

21 Oct 2026, 13:18

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/1cd09aaf47a570bf6b05a7cd06b98e9d35fe82c7 - () https://git.kernel.org/stable/c/8f16b9caf0bdba46044e1d3727ee78291aa36347 -

Information

Published : 2025-07-03 09:15

Updated : 2026-10-30 13:18

NVD link : CVE-2025-38132

Mitre link : CVE-2025-38132

CVE.ORG link : CVE-2025-38132

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

{"id": "CVE-2025-38132", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "02bd588e12df405bdf55244708151b7f238b79ba", "lessThan": "18a3a21c39cca593762aa90f322bd74c18ec59d4", "versionType": "git"}, {"status": "affected", "version": "02bd588e12df405bdf55244708151b7f238b79ba", "lessThan": "1cd09aaf47a570bf6b05a7cd06b98e9d35fe82c7", "versionType": "git"}, {"status": "affected", "version": "02bd588e12df405bdf55244708151b7f238b79ba", "lessThan": "8f16b9caf0bdba46044e1d3727ee78291aa36347", "versionType": "git"}, {"status": "affected", "version": "02bd588e12df405bdf55244708151b7f238b79ba", "lessThan": "42f8afb0b161631fd1d814d017f75f955475ad41", "versionType": "git"}, {"status": "affected", "version": "02bd588e12df405bdf55244708151b7f238b79ba", "lessThan": "53b9e2659719b04f5ba7593f2af0f2335f75e94a", "versionType": "git"}], "programFiles": ["drivers/hwtracing/coresight/coresight-syscfg.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"status": "unaffected", "version": "0", "lessThan": "5.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.3", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/hwtracing/coresight/coresight-syscfg.c"], "defaultStatus": "affected"}]}], "published": "2025-07-03T09:15:27.563", "references": [{"url": "https://git.kernel.org/stable/c/18a3a21c39cca593762aa90f322bd74c18ec59d4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1cd09aaf47a570bf6b05a7cd06b98e9d35fe82c7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/42f8afb0b161631fd1d814d017f75f955475ad41", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/53b9e2659719b04f5ba7593f2af0f2335f75e94a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8f16b9caf0bdba46044e1d3727ee78291aa36347", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: holding cscfg_csdev_lock while removing cscfg from csdev\n\nThere'll be possible race scenario for coresight config:\n\nCPU0 CPU1\n(perf enable) load module\n cscfg_load_config_sets()\n activate config. // sysfs\n (sys_active_cnt == 1)\n...\ncscfg_csdev_enable_active_config()\n lock(csdev->cscfg_csdev_lock)\n deactivate config // sysfs\n (sys_activec_cnt == 0)\n cscfg_unload_config_sets()\n <iterating config_csdev_list> cscfg_remove_owned_csdev_configs()\n // here load config activate by CPU1\n unlock(csdev->cscfg_csdev_lock)\n\niterating config_csdev_list could be raced with config_csdev_list's\nentry delete.\n\nTo resolve this race , hold csdev->cscfg_csdev_lock() while\ncscfg_remove_owned_csdev_configs()"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: coresight: mantener cscfg_csdev_lock mientras se elimina cscfg de csdev Habr\u00e1 un posible escenario de ejecuci\u00f3n para la configuraci\u00f3n de coresight: CPU0 CPU1 (habilitaci\u00f3n de rendimiento) cargar m\u00f3dulo cscfg_load_config_sets() activar configuraci\u00f3n. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) desactiva la configuraci\u00f3n // sysfs (sys_activec_cnt == 0) cscfg_unload_config_sets() cscfg_remove_owned_csdev_configs() // aqu\u00ed se carga la configuraci\u00f3n activada por CPU1 unlock(csdev->cscfg_csdev_lock) iterando config_csdev_list podr\u00eda estar en competencia con la eliminaci\u00f3n de la entrada de config_csdev_list. Para resolver esta competencia, mantenga presionada la tecla csdev->cscfg_csdev_lock() mientras cscfg_remove_owned_csdev_configs()"}], "lastModified": "2026-10-30T13:18:01.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "074848F1-2A7E-490C-B811-A3122505C2CA", "versionEndExcluding": "6.15.3", "versionStartIncluding": "5.17"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}