CVE-2025-38085 (GCVE-0-2025-38085)
Vulnerability from cvelistv5
Published
2025-06-28 07:44
Modified
2026-08-05 11:59
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse.
References
Impacted products
Vendor Product Version
Linux Linux Version: 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa
Version: 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa
Version: 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa
Version: 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa
Version: 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa
Version: 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa
Version: 39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:33:54.315Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38085",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:29.670838Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:12.999Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "952596b08c74e8fe9e2883d1dc8a8f54a37384ec",
              "status": "affected",
              "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa",
              "versionType": "git"
            },
            {
              "lessThan": "a3d864c901a300c295692d129159fc3001a56185",
              "status": "affected",
              "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa",
              "versionType": "git"
            },
            {
              "lessThan": "b7754d3aa7bf9f62218d096c0c8f6c13698fac8b",
              "status": "affected",
              "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa",
              "versionType": "git"
            },
            {
              "lessThan": "fe684290418ef9ef76630072086ee530b92f02b8",
              "status": "affected",
              "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa",
              "versionType": "git"
            },
            {
              "lessThan": "034a52b5ef57c9c8225d94e9067f3390bb33922f",
              "status": "affected",
              "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa",
              "versionType": "git"
            },
            {
              "lessThan": "a6bfeb97941a9187833b526bc6cc4ff5706d0ce9",
              "status": "affected",
              "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa",
              "versionType": "git"
            },
            {
              "lessThan": "1013af4f585fccc4d3e5c5824d174de2257f7d6d",
              "status": "affected",
              "version": "39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.20"
            },
            {
              "lessThan": "2.6.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race\n\nhuge_pmd_unshare() drops a reference on a page table that may have\npreviously been shared across processes, potentially turning it into a\nnormal page table used in another process in which unrelated VMAs can\nafterwards be installed.\n\nIf this happens in the middle of a concurrent gup_fast(), gup_fast() could\nend up walking the page tables of another process.  While I don\u0027t see any\nway in which that immediately leads to kernel memory corruption, it is\nreally weird and unexpected.\n\nFix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),\njust like we do in khugepaged when removing page tables for a THP\ncollapse."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely through local syscalls \u2014 a PUD-aligned MAP_SHARED hugetlbfs/MAP_HUGETLB mapping plus munmap/mremap/mprotect/fallocate to trigger huge_pmd_unshare(), raced against gup_fast() reached via O_DIRECT, io_uring registered buffers or vmsplice. There is no network-facing path into mm/hugetlb.c.\nAC:L - The attacker controls every participant: one thread issues the GUP-fast pin, a sibling thread issues the unmap that calls huge_pmd_unshare(), and a second attacker process reuses the now-exclusively-owned PMD table, and the whole sequence can be looped indefinitely. The gup_fast() IRQ-disabled window can additionally be widened by requesting a full PUD-sized pin range, since the PUD is latched once at the start of gup_fast_pud_range() while the PMD loop then walks 512 entries.\nPR:L - hugetlb_file_setup() performs no capable() check for MAP_HUGETLB anonymous mappings, and none of huge_pmd_unshare()\u0027s callers or the GUP-fast entry points require any capability, so an ordinary local user account suffices. Only a configured hugepage pool is needed, which is standard on cloud, virtualization, DPDK and database hosts.\nUI:N - Exploitation is fully self-contained \u2014 the attacker forks its own second process to establish PMD sharing and to repurpose the unshared page table. No victim action is required at any point.\nS:U - The defect and its impact are both within the kernel\u0027s own memory-management security authority, with no VM, IOMMU or sandbox boundary crossed. This is a standard kernel memory-safety/privilege-escalation shape, so scope remains Unchanged.\nC:H - A gup_fast() walker that latched the stale PUD proceeds to walk a PMD table that now backs a different process\u0027s address space, pinning and returning struct pages that belong to that other mm. Handing those pages to O_DIRECT or vmsplice yields a direct read primitive against another process\u0027s memory, which on hosts where a hugetlbfs segment is shared across trust boundaries (QEMU/vhost-user, DPDK/SPDK, shared DB segments) discloses privileged data.\nI:H - The same stale walk with FOLL_WRITE returns writable pins on pages mapped by the foreign address space, so an O_DIRECT read or io_uring write into that buffer modifies another process\u0027s memory arbitrarily. It also leaves DMA pins and page reference/mapcount state established behind the back of the owning mm, corrupting page-table and pinning invariants the kernel relies on.\nA:H - GUP-fast traversing page tables of an unrelated address space while that process is concurrently tearing down and re-populating them is exactly the unsynchronized page-table access the kernel elsewhere prevents with tlb_remove_table_sync_one(), and it readily produces inconsistent refcount/mapcount state, VM_WARN/BUG trips, and oops in mm paths. The race can be re-armed in a loop by an unprivileged process."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:23.457Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/952596b08c74e8fe9e2883d1dc8a8f54a37384ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3d864c901a300c295692d129159fc3001a56185"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7754d3aa7bf9f62218d096c0c8f6c13698fac8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe684290418ef9ef76630072086ee530b92f02b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/034a52b5ef57c9c8225d94e9067f3390bb33922f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6bfeb97941a9187833b526bc6cc4ff5706d0ce9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1013af4f585fccc4d3e5c5824d174de2257f7d6d"
        },
        {
          "url": "https://project-zero.issues.chromium.org/issues/420715744"
        }
      ],
      "title": "mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38085",
    "datePublished": "2025-06-28T07:44:26.178Z",
    "dateReserved": "2025-04-16T04:51:23.981Z",
    "dateUpdated": "2026-08-05T11:59:23.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T17:33:54.315Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38085\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:41:29.670838Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:38:25.112Z\"}}], \"cna\": {\"title\": \"mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The race is driven entirely through local syscalls \\u2014 a PUD-aligned MAP_SHARED hugetlbfs/MAP_HUGETLB mapping plus munmap/mremap/mprotect/fallocate to trigger huge_pmd_unshare(), raced against gup_fast() reached via O_DIRECT, io_uring registered buffers or vmsplice. There is no network-facing path into mm/hugetlb.c.\\nAC:L - The attacker controls every participant: one thread issues the GUP-fast pin, a sibling thread issues the unmap that calls huge_pmd_unshare(), and a second attacker process reuses the now-exclusively-owned PMD table, and the whole sequence can be looped indefinitely. The gup_fast() IRQ-disabled window can additionally be widened by requesting a full PUD-sized pin range, since the PUD is latched once at the start of gup_fast_pud_range() while the PMD loop then walks 512 entries.\\nPR:L - hugetlb_file_setup() performs no capable() check for MAP_HUGETLB anonymous mappings, and none of huge_pmd_unshare()\u0027s callers or the GUP-fast entry points require any capability, so an ordinary local user account suffices. Only a configured hugepage pool is needed, which is standard on cloud, virtualization, DPDK and database hosts.\\nUI:N - Exploitation is fully self-contained \\u2014 the attacker forks its own second process to establish PMD sharing and to repurpose the unshared page table. No victim action is required at any point.\\nS:U - The defect and its impact are both within the kernel\u0027s own memory-management security authority, with no VM, IOMMU or sandbox boundary crossed. This is a standard kernel memory-safety/privilege-escalation shape, so scope remains Unchanged.\\nC:H - A gup_fast() walker that latched the stale PUD proceeds to walk a PMD table that now backs a different process\u0027s address space, pinning and returning struct pages that belong to that other mm. Handing those pages to O_DIRECT or vmsplice yields a direct read primitive against another process\u0027s memory, which on hosts where a hugetlbfs segment is shared across trust boundaries (QEMU/vhost-user, DPDK/SPDK, shared DB segments) discloses privileged data.\\nI:H - The same stale walk with FOLL_WRITE returns writable pins on pages mapped by the foreign address space, so an O_DIRECT read or io_uring write into that buffer modifies another process\u0027s memory arbitrarily. It also leaves DMA pins and page reference/mapcount state established behind the back of the owning mm, corrupting page-table and pinning invariants the kernel relies on.\\nA:H - GUP-fast traversing page tables of an unrelated address space while that process is concurrently tearing down and re-populating them is exactly the unsynchronized page-table access the kernel elsewhere prevents with tlb_remove_table_sync_one(), and it readily produces inconsistent refcount/mapcount state, VM_WARN/BUG trips, and oops in mm paths. The race can be re-armed in a loop by an unprivileged process.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa\", \"lessThan\": \"952596b08c74e8fe9e2883d1dc8a8f54a37384ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa\", \"lessThan\": \"a3d864c901a300c295692d129159fc3001a56185\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa\", \"lessThan\": \"b7754d3aa7bf9f62218d096c0c8f6c13698fac8b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa\", \"lessThan\": \"fe684290418ef9ef76630072086ee530b92f02b8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa\", \"lessThan\": \"034a52b5ef57c9c8225d94e9067f3390bb33922f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa\", \"lessThan\": \"a6bfeb97941a9187833b526bc6cc4ff5706d0ce9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"39dde65c9940c97fcd178a3d2b1c57ed8b7b68aa\", \"lessThan\": \"1013af4f585fccc4d3e5c5824d174de2257f7d6d\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/hugetlb.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.239\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.186\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.142\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.95\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/hugetlb.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/952596b08c74e8fe9e2883d1dc8a8f54a37384ec\"}, {\"url\": \"https://git.kernel.org/stable/c/a3d864c901a300c295692d129159fc3001a56185\"}, {\"url\": \"https://git.kernel.org/stable/c/b7754d3aa7bf9f62218d096c0c8f6c13698fac8b\"}, {\"url\": \"https://git.kernel.org/stable/c/fe684290418ef9ef76630072086ee530b92f02b8\"}, {\"url\": \"https://git.kernel.org/stable/c/034a52b5ef57c9c8225d94e9067f3390bb33922f\"}, {\"url\": \"https://git.kernel.org/stable/c/a6bfeb97941a9187833b526bc6cc4ff5706d0ce9\"}, {\"url\": \"https://git.kernel.org/stable/c/1013af4f585fccc4d3e5c5824d174de2257f7d6d\"}, {\"url\": \"https://project-zero.issues.chromium.org/issues/420715744\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race\\n\\nhuge_pmd_unshare() drops a reference on a page table that may have\\npreviously been shared across processes, potentially turning it into a\\nnormal page table used in another process in which unrelated VMAs can\\nafterwards be installed.\\n\\nIf this happens in the middle of a concurrent gup_fast(), gup_fast() could\\nend up walking the page tables of another process.  While I don\u0027t see any\\nway in which that immediately leads to kernel memory corruption, it is\\nreally weird and unexpected.\\n\\nFix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),\\njust like we do in khugepaged when removing page tables for a THP\\ncollapse.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.239\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.186\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.142\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.95\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.35\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15.4\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16\", \"versionStartIncluding\": \"2.6.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:59:23.457Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-38085\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:59:23.457Z\", \"dateReserved\": \"2025-04-16T04:51:23.981Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-06-28T07:44:26.178Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.