CVE-2025-38733

{"id": "CVE-2025-38733", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38733", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:53:03.211075Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "32db401965f165f7c44447d0508097f070c8f576", "lessThan": "30bf5728bb217a6d1ba73f44094c9b9c6bc9a567", "versionType": "git"}, {"status": "affected", "version": "32db401965f165f7c44447d0508097f070c8f576", "lessThan": "1d7864acd497cb468a998d44631f84896f885e85", "versionType": "git"}, {"status": "affected", "version": "32db401965f165f7c44447d0508097f070c8f576", "lessThan": "93f616ff870a1fb7e84d472cad0af651b18f9f87", "versionType": "git"}, {"status": "affected", "version": "0b99d0e17d6a73a0526f92bc6b54b2b95e67a31d", "versionType": "git"}, {"status": "affected", "version": "6.10.11", "lessThan": "6.11", "versionType": "semver"}], "programFiles": ["arch/s390/boot/vmem.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.44", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.4", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/s390/boot/vmem.c"], "defaultStatus": "affected"}]}], "published": "2025-09-05T18:15:42.550", "references": [{"url": "https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Do not map lowcore with identity mapping\n\nSince the identity mapping is pinned to address zero the lowcore is always\nalso mapped to address zero, this happens regardless of the relocate_lowcore\ncommand line option. If the option is specified the lowcore is mapped\ntwice, instead of only once.\n\nThis means that NULL pointer accesses will succeed instead of causing an\nexception (low address protection still applies, but covers only parts).\nTo fix this never map the first two pages of physical memory with the\nidentity mapping."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ns390/mm: No mapear lowcore con mapeo de identidad\n\nDado que el mapeo de identidad est\u00e1 anclado a la direcci\u00f3n cero, el lowcore siempre tambi\u00e9n se mapea a la direcci\u00f3n cero, esto ocurre independientemente de la opci\u00f3n de l\u00ednea de comandos relocate_lowcore. Si la opci\u00f3n se especifica, el lowcore se mapea dos veces, en lugar de solo una vez.\n\nEsto significa que los accesos a punteros NULL tendr\u00e1n \u00e9xito en lugar de causar una excepci\u00f3n (la protecci\u00f3n de direcciones bajas a\u00fan se aplica, pero cubre solo partes). Para solucionar esto, nunca mapear las primeras dos p\u00e1ginas de memoria f\u00edsica con el mapeo de identidad."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE0F2E18-08FB-405F-82A3-EAD7810E842D", "versionEndExcluding": "6.11", "versionStartIncluding": "6.10.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4D50845-A441-49B4-934F-FC9AE00C40F0", "versionEndExcluding": "6.12.44", "versionStartIncluding": "6.11.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4770BA57-3F3F-493B-8608-EC3B25254949"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B77A9280-37E6-49AD-B559-5B23A3B1DC3D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE5298B3-04B4-4F3E-B186-01A58B5C75A6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}