CVE-2025-38733 (GCVE-0-2025-38733)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:20 – Updated: 2026-10-15 22:02
VLAI
Title
s390/mm: Do not map lowcore with identity mapping
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/mm: Do not map lowcore with identity mapping Since the identity mapping is pinned to address zero the lowcore is always also mapped to address zero, this happens regardless of the relocate_lowcore command line option. If the option is specified the lowcore is mapped twice, instead of only once. This means that NULL pointer accesses will succeed instead of causing an exception (low address protection still applies, but covers only parts). To fix this never map the first two pages of physical memory with the identity mapping.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:53 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6843 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 32db401965f165f7c44447d0508097f070c8f576 , < 30bf5728bb217a6d1ba73f44094c9b9c6bc9a567 (git)
Affected: 32db401965f165f7c44447d0508097f070c8f576 , < 1d7864acd497cb468a998d44631f84896f885e85 (git)
Affected: 32db401965f165f7c44447d0508097f070c8f576 , < 93f616ff870a1fb7e84d472cad0af651b18f9f87 (git)
Affected: 0b99d0e17d6a73a0526f92bc6b54b2b95e67a31d (git)
Affected: 6.10.11 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.44 , ≤ 6.12.* (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38733",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:53:03.211075Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:28.665Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/vmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "30bf5728bb217a6d1ba73f44094c9b9c6bc9a567",
              "status": "affected",
              "version": "32db401965f165f7c44447d0508097f070c8f576",
              "versionType": "git"
            },
            {
              "lessThan": "1d7864acd497cb468a998d44631f84896f885e85",
              "status": "affected",
              "version": "32db401965f165f7c44447d0508097f070c8f576",
              "versionType": "git"
            },
            {
              "lessThan": "93f616ff870a1fb7e84d472cad0af651b18f9f87",
              "status": "affected",
              "version": "32db401965f165f7c44447d0508097f070c8f576",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b99d0e17d6a73a0526f92bc6b54b2b95e67a31d",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/vmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Do not map lowcore with identity mapping\n\nSince the identity mapping is pinned to address zero the lowcore is always\nalso mapped to address zero, this happens regardless of the relocate_lowcore\ncommand line option. If the option is specified the lowcore is mapped\ntwice, instead of only once.\n\nThis means that NULL pointer accesses will succeed instead of causing an\nexception (low address protection still applies, but covers only parts).\nTo fix this never map the first two pages of physical memory with the\nidentity mapping."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defective mapping is created by the s390 boot-time page table setup and is leveraged by triggering a kernel NULL pointer dereference, which requires the ability to execute code/syscalls on the affected system. No network protocol handler is involved in the flawed mapping itself.\nAC:L - The identity base is pinned to zero in all default (non-DEBUG_VM) builds, and the lowcore layout at virtual address 0 is a fixed, publicly documented ABI, so the read/write offsets are fully deterministic with no race or memory-layout uncertainty for the attacker to lose.\nPR:L - An ordinary unprivileged local user can reach kernel code paths containing NULL-dereference bugs (many via syscalls, ioctls, or user namespaces); no capability or administrative privilege is needed to convert those into lowcore accesses.\nUI:N - The mapping is established unconditionally at boot and the dereference is triggered directly by the attacker\u0027s own syscall; no action by any other user is required.\nS:U - The corrupted resource is the kernel\u0027s own per-CPU lowcore within the same security authority as the kernel; no hypervisor, IOMMU, or guest/host boundary is crossed.\nC:H - NULL reads now succeed and return lowcore contents, disclosing the stack canary (0x240), current_task (0x340), kernel_stack (0x348), kernel_asce (0x388), and percpu_offset (0x3b8); a large identity page at address 0 additionally exposes the first megabyte of physical memory, and hijacking user_asce or current_task escalates this to arbitrary kernel memory read.\nI:H - Writes to offsets outside low address protection\u0027s 0-511/4096-4607 windows silently corrupt return_psw (0x290), current_task (0x340), the kernel/async/nodat/mcck stack pointers, restart_fn (0x370), and kernel_asce/user_asce, giving kernel control-flow hijack and full privilege escalation instead of a fault.\nA:H - Silent corruption of the lowcore \u2014 the CPU\u0027s PSW, stack pointer, ASCE, and current-task state \u2014 produces immediate kernel panics or undefined CPU behavior, and the missing exception means faults that would have been a contained oops instead destabilize the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:23.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85"
        },
        {
          "url": "https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87"
        }
      ],
      "title": "s390/mm: Do not map lowcore with identity mapping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38733",
    "datePublished": "2025-09-05T17:20:33.075Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-10-15T22:02:28.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38733",
      "date": "2026-10-22",
      "epss": "0.00166",
      "percentile": "0.05507"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/s390/boot/vmem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "30bf5728bb217a6d1ba73f44094c9b9c6bc9a567",
                    "status": "affected",
                    "version": "32db401965f165f7c44447d0508097f070c8f576",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1d7864acd497cb468a998d44631f84896f885e85",
                    "status": "affected",
                    "version": "32db401965f165f7c44447d0508097f070c8f576",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "93f616ff870a1fb7e84d472cad0af651b18f9f87",
                    "status": "affected",
                    "version": "32db401965f165f7c44447d0508097f070c8f576",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "0b99d0e17d6a73a0526f92bc6b54b2b95e67a31d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "affected",
                    "version": "6.10.11",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/s390/boot/vmem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AE0F2E18-08FB-405F-82A3-EAD7810E842D",
                    "versionEndExcluding": "6.11",
                    "versionStartIncluding": "6.10.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4D50845-A441-49B4-934F-FC9AE00C40F0",
                    "versionEndExcluding": "6.12.44",
                    "versionStartIncluding": "6.11.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D",
                    "versionEndExcluding": "6.16.4",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*",
                    "matchCriteriaId": "4770BA57-3F3F-493B-8608-EC3B25254949",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "B77A9280-37E6-49AD-B559-5B23A3B1DC3D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "DE5298B3-04B4-4F3E-B186-01A58B5C75A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Do not map lowcore with identity mapping\n\nSince the identity mapping is pinned to address zero the lowcore is always\nalso mapped to address zero, this happens regardless of the relocate_lowcore\ncommand line option. If the option is specified the lowcore is mapped\ntwice, instead of only once.\n\nThis means that NULL pointer accesses will succeed instead of causing an\nexception (low address protection still applies, but covers only parts).\nTo fix this never map the first two pages of physical memory with the\nidentity mapping."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ns390/mm: No mapear lowcore con mapeo de identidad\n\nDado que el mapeo de identidad est\u00e1 anclado a la direcci\u00f3n cero, el lowcore siempre tambi\u00e9n se mapea a la direcci\u00f3n cero, esto ocurre independientemente de la opci\u00f3n de l\u00ednea de comandos relocate_lowcore. Si la opci\u00f3n se especifica, el lowcore se mapea dos veces, en lugar de solo una vez.\n\nEsto significa que los accesos a punteros NULL tendr\u00e1n \u00e9xito en lugar de causar una excepci\u00f3n (la protecci\u00f3n de direcciones bajas a\u00fan se aplica, pero cubre solo partes). Para solucionar esto, nunca mapear las primeras dos p\u00e1ginas de memoria f\u00edsica con el mapeo de identidad."
          }
        ],
        "id": "CVE-2025-38733",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-38733",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:53:03.211075Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-05T18:15:42.550",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-10-16T23:23:59+00:00",
      "cve": "CVE-2025-38733",
      "id": "CVE-2025-38733",
      "initial_release_date": "2025-09-05T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service due to incorrect lowcore memory mapping",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38733.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-38733",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T21:53:03.211075Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T21:53:04.364Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "arch/s390/boot/vmem.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "30bf5728bb217a6d1ba73f44094c9b9c6bc9a567",
                  "status": "affected",
                  "version": "32db401965f165f7c44447d0508097f070c8f576",
                  "versionType": "git"
                },
                {
                  "lessThan": "1d7864acd497cb468a998d44631f84896f885e85",
                  "status": "affected",
                  "version": "32db401965f165f7c44447d0508097f070c8f576",
                  "versionType": "git"
                },
                {
                  "lessThan": "93f616ff870a1fb7e84d472cad0af651b18f9f87",
                  "status": "affected",
                  "version": "32db401965f165f7c44447d0508097f070c8f576",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "0b99d0e17d6a73a0526f92bc6b54b2b95e67a31d",
                  "versionType": "git"
                },
                {
                  "lessThan": "6.11",
                  "status": "affected",
                  "version": "6.10.11",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "arch/s390/boot/vmem.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.11"
                },
                {
                  "lessThan": "6.11",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.44",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.16.*",
                  "status": "unaffected",
                  "version": "6.16.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.17",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.44",
                      "versionStartIncluding": "6.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.16.4",
                      "versionStartIncluding": "6.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.17",
                      "versionStartIncluding": "6.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "6.10.11",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Do not map lowcore with identity mapping\n\nSince the identity mapping is pinned to address zero the lowcore is always\nalso mapped to address zero, this happens regardless of the relocate_lowcore\ncommand line option. If the option is specified the lowcore is mapped\ntwice, instead of only once.\n\nThis means that NULL pointer accesses will succeed instead of causing an\nexception (low address protection still applies, but covers only parts).\nTo fix this never map the first two pages of physical memory with the\nidentity mapping."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The defective mapping is created by the s390 boot-time page table setup and is leveraged by triggering a kernel NULL pointer dereference, which requires the ability to execute code/syscalls on the affected system. No network protocol handler is involved in the flawed mapping itself.\nAC:L - The identity base is pinned to zero in all default (non-DEBUG_VM) builds, and the lowcore layout at virtual address 0 is a fixed, publicly documented ABI, so the read/write offsets are fully deterministic with no race or memory-layout uncertainty for the attacker to lose.\nPR:L - An ordinary unprivileged local user can reach kernel code paths containing NULL-dereference bugs (many via syscalls, ioctls, or user namespaces); no capability or administrative privilege is needed to convert those into lowcore accesses.\nUI:N - The mapping is established unconditionally at boot and the dereference is triggered directly by the attacker\u0027s own syscall; no action by any other user is required.\nS:U - The corrupted resource is the kernel\u0027s own per-CPU lowcore within the same security authority as the kernel; no hypervisor, IOMMU, or guest/host boundary is crossed.\nC:H - NULL reads now succeed and return lowcore contents, disclosing the stack canary (0x240), current_task (0x340), kernel_stack (0x348), kernel_asce (0x388), and percpu_offset (0x3b8); a large identity page at address 0 additionally exposes the first megabyte of physical memory, and hijacking user_asce or current_task escalates this to arbitrary kernel memory read.\nI:H - Writes to offsets outside low address protection\u0027s 0-511/4096-4607 windows silently corrupt return_psw (0x290), current_task (0x340), the kernel/async/nodat/mcck stack pointers, restart_fn (0x370), and kernel_asce/user_asce, giving kernel control-flow hijack and full privilege escalation instead of a fault.\nA:H - Silent corruption of the lowcore \u2014 the CPU\u0027s PSW, stack pointer, ASCE, and current-task state \u2014 produces immediate kernel panics or undefined CPU behavior, and the missing exception means faults that would have been a contained oops instead destabilize the whole system."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T12:04:23.788Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567"
            },
            {
              "url": "https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85"
            },
            {
              "url": "https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87"
            }
          ],
          "title": "s390/mm: Do not map lowcore with identity mapping",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-38733",
        "datePublished": "2025-09-05T17:20:33.075Z",
        "dateReserved": "2025-04-16T04:51:24.033Z",
        "dateUpdated": "2026-10-15T22:02:28.665Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.