Login Sign Up

CVE-2025-38067

5.5 MEDIUM
Denial of Service

📋 TL;DR

A Linux kernel vulnerability in the rseq (restartable sequences) subsystem allows local attackers to cause a segmentation fault (crash) when registering rseq with a non-zero rseq_cs field. This affects systems running vulnerable Linux kernel versions with rseq enabled, primarily impacting multi-threaded applications using older glibc versions.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Specific vulnerable versions not explicitly stated in CVE; likely affects kernels with rseq support before the fix commits.
Operating Systems: Linux distributions with vulnerable kernel versions
Default Config Vulnerable: ⚠️ Yes
Notes: Requires rseq subsystem to be enabled/used; older glibc versions that reuse rseq areas without clearing rseq_cs increase exposure.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local denial of service causing kernel panic or system crash, potentially disrupting critical services.

🟠

Likely Case

Application crash or segmentation fault in multi-threaded programs using rseq with older glibc, leading to service disruption.

🟢

If Mitigated

Minimal impact with proper kernel patching; applications continue functioning normally.

🌐 Internet-Facing: LOW - Requires local access; not remotely exploitable.
🏢 Internal Only: MEDIUM - Local users or processes can crash applications/systems; privilege escalation not demonstrated.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW - Simple local trigger via rseq registration with non-zero rseq_cs.

Exploitation requires local access and ability to trigger rseq registration; no evidence of weaponization in wild.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 2df285dab00fa03a3ef939b6cb0d0d0aeb0791db, 3e4028ef31b69286c9d4878cee0330235f53f218, 48900d839a3454050fd5822e34be8d54c4ec9b86, b2b05d0dc2f4f0646922068af435aed5763d16ba, eaf112069a904b6207b4106ff083e0208232a2eb

Vendor Advisory: https://git.kernel.org/stable/c/2df285dab00fa03a3ef939b6cb0d0d0aeb0791db

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version post-reboot.

🔧 Temporary Workarounds

Disable rseq via kernel boot parameter

linux

Prevents rseq subsystem from being used, mitigating vulnerability.

Add 'nordseq' to kernel boot parameters in GRUB configuration

🧯 If You Can't Patch

  • Restrict local user access to minimize attack surface.
  • Monitor systems for segmentation faults in applications using rseq.

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if rseq is enabled; vulnerable if using unpatched kernel with rseq support.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits; test rseq registration functionality.

📡 Detection & Monitoring

Log Indicators:

  • Segmentation fault logs in application/system logs related to rseq operations
  • Kernel panic logs

Network Indicators:

  • None - local vulnerability only

SIEM Query:

Search for 'segmentation fault' or 'sigsegv' in logs with process names using rseq.

📊 Metadata

CVE ID: CVE-2025-38067
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score: 0.03% exploit probability (8.7th percentile)
Published: June 18, 2025
Last Updated: December 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON