CVE-2025-38670

Q: What is the severity of CVE-2025-38670?

CVE-2025-38670 has a CVSS score of 7.1 (HIGH). This Linux kernel vulnerability allows interrupt handlers to corrupt stack pointers during context switching, potentially leading to kernel panics and system crashes. It affects ARM64 systems running vulnerable Linux kernel versions, particularly those with CONFIG_ARM64_PSEUDO_NMI enabled where exploitation becomes more likely.

7.1 HIGH

Denial of Service

📋 TL;DR

This Linux kernel vulnerability allows interrupt handlers to corrupt stack pointers during context switching, potentially leading to kernel panics and system crashes. It affects ARM64 systems running vulnerable Linux kernel versions, particularly those with CONFIG_ARM64_PSEUDO_NMI enabled where exploitation becomes more likely.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions not specified in CVE; check kernel commit history for affected versions

Operating Systems: Linux distributions with ARM64 architecture support

Default Config Vulnerable: ✅ No

Notes: Vulnerability exists in default config but exploitation is unlikely without CONFIG_ARM64_PSEUDO_NMI enabled. With pseudo-NMI enabled, exploitation becomes much more probable.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, denial of service, and potential data corruption or loss.

🟠

Likely Case

System instability, occasional kernel panics under specific interrupt-heavy workloads, particularly with pseudo-NMI enabled.

🟢

If Mitigated

Minimal impact with proper patching; systems without pseudo-NMI configuration are unlikely to experience issues.

🌐 Internet-Facing: LOW - This is a kernel-level vulnerability requiring local access or ability to trigger specific interrupt conditions.

🏢 Internal Only: MEDIUM - Local attackers or malicious processes could potentially trigger the vulnerability to cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires precise timing and ability to trigger interrupts during specific kernel operations. More feasible with pseudo-NMI enabled.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 0f67015d72627bad72da3c2084352e0aa134416b, 407047893a64399f2d2390ff35cc6061107d805d, 708fd522b86d2a9544c34ec6a86fa3fc23336525, 9433a5f437b0948d6a2d8a02ad7a42ab7ca27a61, a6b0cb523eaa01efe8a3f76ced493ba60674c6e6

Vendor Advisory: https://git.kernel.org/stable/c/0f67015d72627bad72da3c2084352e0aa134416b

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits
2. Reboot system to load new kernel
3. Verify kernel version after reboot

🔧 Temporary Workarounds

Disable CONFIG_ARM64_PSEUDO_NMI

linux

Disabling pseudo-NMI reduces likelihood of exploitation by preventing interrupts during vulnerable operations

# Rebuild kernel with CONFIG_ARM64_PSEUDO_NMI=n

🧯 If You Can't Patch

Monitor system logs for kernel panic indicators and unexpected crashes
Limit system workload and interrupt-heavy operations on vulnerable systems

🔍 How to Verify

Check if Vulnerable:

Check if kernel version is before the fix commits: git log --oneline | grep -E '0f67015d72627bad72da3c2084352e0aa134416b|407047893a64399f2d2390ff35cc6061107d805d|708fd522b86d2a9544c34ec6a86fa3fc23336525|9433a5f437b0948d6a2d8a02ad7a42ab7ca27a61|a6b0cb523eaa01efe8a3f76ced493ba60674c6e6'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel contains fix commits: uname -r and check kernel changelog for the specific commit hashes

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
Unexpected system crashes or reboots
Stack corruption error messages

Network Indicators:

None - this is a local kernel vulnerability

SIEM Query:

source="kern.log" AND ("kernel panic" OR "stack corruption" OR "unhandled exception")

📊 Metadata

CVE ID: CVE-2025-38670

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-668

EPSS Score: 0.02% exploit probability (2.7th percentile)

Published: August 22, 2025

Last Updated: January 22, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable CONFIG_ARM64_PSEUDO_NMI

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities