Vulnerability-Lookup

GHSA-MFMJ-296R-5FQR

Vulnerability from github – Published: 2025-07-04 15:31 – Updated: 2025-11-18 18:32

Details

In the Linux kernel, the following vulnerability has been resolved:

powerpc64/ftrace: fix clobbered r15 during livepatching

While r15 is clobbered always with PPC_FTRACE_OUT_OF_LINE, it is not restored in livepatch sequence leading to not so obvious fails like below:

BUG: Unable to handle kernel data access on write at 0xc0000000000f9078 Faulting instruction address: 0xc0000000018ff958 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP: c0000000018ff958 LR: c0000000018ff930 CTR: c0000000009c0790 REGS: c00000005f2e7790 TRAP: 0300 Tainted: G K (6.14.0+) MSR: 8000000000009033 CR: 2822880b XER: 20040000 CFAR: c0000000008addc0 DAR: c0000000000f9078 DSISR: 0a000000 IRQMASK: 1 GPR00: c0000000018f2584 c00000005f2e7a30 c00000000280a900 c000000017ffa488 GPR04: 0000000000000008 0000000000000000 c0000000018f24fc 000000000000000d GPR08: fffffffffffe0000 000000000000000d 0000000000000000 0000000000008000 GPR12: c0000000009c0790 c000000017ffa480 c00000005f2e7c78 c0000000000f9070 GPR16: c00000005f2e7c90 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 c00000005f3efa80 c00000005f2e7c60 c00000005f2e7c88 GPR24: c00000005f2e7c60 0000000000000001 c0000000000f9078 0000000000000000 GPR28: 00007fff97960000 c000000017ffa480 0000000000000000 c0000000000f9078 ... Call Trace: check_heap_object+0x34/0x390 (unreliable) __mutex_unlock_slowpath.isra.0+0xe4/0x230 seq_read_iter+0x430/0xa90 proc_reg_read_iter+0xa4/0x200 vfs_read+0x41c/0x510 ksys_read+0xa4/0x190 system_call_exception+0x1d0/0x440 system_call_vectored_common+0x15c/0x2ec

Fix it by restoring r15 always.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-38233"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-04T14:15:32Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc64/ftrace: fix clobbered r15 during livepatching\n\nWhile r15 is clobbered always with PPC_FTRACE_OUT_OF_LINE, it is\nnot restored in livepatch sequence leading to not so obvious fails\nlike below:\n\n  BUG: Unable to handle kernel data access on write at 0xc0000000000f9078\n  Faulting instruction address: 0xc0000000018ff958\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  ...\n  NIP:  c0000000018ff958 LR: c0000000018ff930 CTR: c0000000009c0790\n  REGS: c00000005f2e7790 TRAP: 0300   Tainted: G              K      (6.14.0+)\n  MSR:  8000000000009033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 2822880b  XER: 20040000\n  CFAR: c0000000008addc0 DAR: c0000000000f9078 DSISR: 0a000000 IRQMASK: 1\n  GPR00: c0000000018f2584 c00000005f2e7a30 c00000000280a900 c000000017ffa488\n  GPR04: 0000000000000008 0000000000000000 c0000000018f24fc 000000000000000d\n  GPR08: fffffffffffe0000 000000000000000d 0000000000000000 0000000000008000\n  GPR12: c0000000009c0790 c000000017ffa480 c00000005f2e7c78 c0000000000f9070\n  GPR16: c00000005f2e7c90 0000000000000000 0000000000000000 0000000000000000\n  GPR20: 0000000000000000 c00000005f3efa80 c00000005f2e7c60 c00000005f2e7c88\n  GPR24: c00000005f2e7c60 0000000000000001 c0000000000f9078 0000000000000000\n  GPR28: 00007fff97960000 c000000017ffa480 0000000000000000 c0000000000f9078\n  ...\n  Call Trace:\n    check_heap_object+0x34/0x390 (unreliable)\n  __mutex_unlock_slowpath.isra.0+0xe4/0x230\n  seq_read_iter+0x430/0xa90\n  proc_reg_read_iter+0xa4/0x200\n  vfs_read+0x41c/0x510\n  ksys_read+0xa4/0x190\n  system_call_exception+0x1d0/0x440\n  system_call_vectored_common+0x15c/0x2ec\n\nFix it by restoring r15 always.",
  "id": "GHSA-mfmj-296r-5fqr",
  "modified": "2025-11-18T18:32:47Z",
  "published": "2025-07-04T15:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38233"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a9212bf5ca640232254b31330e86272fe4073bc9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cb5b691f8273432297611863ac142e17119279e0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-38233 (GCVE-0-2025-38233)

Vulnerability from cvelistv5 – Published: 2025-07-04 13:37 – Updated: 2026-08-05 12:00

Title

powerpc64/ftrace: fix clobbered r15 during livepatching

Summary

In the Linux kernel, the following vulnerability has been resolved: powerpc64/ftrace: fix clobbered r15 during livepatching While r15 is clobbered always with PPC_FTRACE_OUT_OF_LINE, it is not restored in livepatch sequence leading to not so obvious fails like below: BUG: Unable to handle kernel data access on write at 0xc0000000000f9078 Faulting instruction address: 0xc0000000018ff958 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP: c0000000018ff958 LR: c0000000018ff930 CTR: c0000000009c0790 REGS: c00000005f2e7790 TRAP: 0300 Tainted: G K (6.14.0+) MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 2822880b XER: 20040000 CFAR: c0000000008addc0 DAR: c0000000000f9078 DSISR: 0a000000 IRQMASK: 1 GPR00: c0000000018f2584 c00000005f2e7a30 c00000000280a900 c000000017ffa488 GPR04: 0000000000000008 0000000000000000 c0000000018f24fc 000000000000000d GPR08: fffffffffffe0000 000000000000000d 0000000000000000 0000000000008000 GPR12: c0000000009c0790 c000000017ffa480 c00000005f2e7c78 c0000000000f9070 GPR16: c00000005f2e7c90 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 c00000005f3efa80 c00000005f2e7c60 c00000005f2e7c88 GPR24: c00000005f2e7c60 0000000000000001 c0000000000f9078 0000000000000000 GPR28: 00007fff97960000 c000000017ffa480 0000000000000000 c0000000000f9078 ... Call Trace: check_heap_object+0x34/0x390 (unreliable) __mutex_unlock_slowpath.isra.0+0xe4/0x230 seq_read_iter+0x430/0xa90 proc_reg_read_iter+0xa4/0x200 vfs_read+0x41c/0x510 ksys_read+0xa4/0x190 system_call_exception+0x1d0/0x440 system_call_vectored_common+0x15c/0x2ec Fix it by restoring r15 always.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6641 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/a9212bf5ca6402322…
https://git.kernel.org/stable/c/cb5b691f827343229…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: eec37961a56aa4f3fe1c33ffd48eec7d1bb0c009 , < a9212bf5ca640232254b31330e86272fe4073bc9 (git) Affected: eec37961a56aa4f3fe1c33ffd48eec7d1bb0c009 , < cb5b691f8273432297611863ac142e17119279e0 (git)
Linux	Linux	Affected: 6.13 Unaffected: 0 , < 6.13 (semver) Unaffected: 6.15.4 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/trace/ftrace_entry.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a9212bf5ca640232254b31330e86272fe4073bc9",
              "status": "affected",
              "version": "eec37961a56aa4f3fe1c33ffd48eec7d1bb0c009",
              "versionType": "git"
            },
            {
              "lessThan": "cb5b691f8273432297611863ac142e17119279e0",
              "status": "affected",
              "version": "eec37961a56aa4f3fe1c33ffd48eec7d1bb0c009",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/trace/ftrace_entry.S"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc64/ftrace: fix clobbered r15 during livepatching\n\nWhile r15 is clobbered always with PPC_FTRACE_OUT_OF_LINE, it is\nnot restored in livepatch sequence leading to not so obvious fails\nlike below:\n\n  BUG: Unable to handle kernel data access on write at 0xc0000000000f9078\n  Faulting instruction address: 0xc0000000018ff958\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  ...\n  NIP:  c0000000018ff958 LR: c0000000018ff930 CTR: c0000000009c0790\n  REGS: c00000005f2e7790 TRAP: 0300   Tainted: G              K      (6.14.0+)\n  MSR:  8000000000009033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 2822880b  XER: 20040000\n  CFAR: c0000000008addc0 DAR: c0000000000f9078 DSISR: 0a000000 IRQMASK: 1\n  GPR00: c0000000018f2584 c00000005f2e7a30 c00000000280a900 c000000017ffa488\n  GPR04: 0000000000000008 0000000000000000 c0000000018f24fc 000000000000000d\n  GPR08: fffffffffffe0000 000000000000000d 0000000000000000 0000000000008000\n  GPR12: c0000000009c0790 c000000017ffa480 c00000005f2e7c78 c0000000000f9070\n  GPR16: c00000005f2e7c90 0000000000000000 0000000000000000 0000000000000000\n  GPR20: 0000000000000000 c00000005f3efa80 c00000005f2e7c60 c00000005f2e7c88\n  GPR24: c00000005f2e7c60 0000000000000001 c0000000000f9078 0000000000000000\n  GPR28: 00007fff97960000 c000000017ffa480 0000000000000000 c0000000000f9078\n  ...\n  Call Trace:\n    check_heap_object+0x34/0x390 (unreliable)\n  __mutex_unlock_slowpath.isra.0+0xe4/0x230\n  seq_read_iter+0x430/0xa90\n  proc_reg_read_iter+0xa4/0x200\n  vfs_read+0x41c/0x510\n  ksys_read+0xa4/0x190\n  system_call_exception+0x1d0/0x440\n  system_call_vectored_common+0x15c/0x2ec\n\nFix it by restoring r15 always."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The corrupted register is consumed by ordinary kernel code paths entered through local syscalls \u2014 the reported oops comes from a plain read(2) on a procfs file (`ksys_read \u2192 vfs_read \u2192 seq_read_iter`). No network protocol handler is inherently involved; reaching the defect requires executing kernel code on the machine.\nAC:L - With a livepatch active, the missing `REST_GPR(15, r1)` executes on 100% of calls to any patched function \u2014 no race, no memory-layout dependency, no timing window. The enabling configuration (ppc64le with `PPC_FTRACE_OUT_OF_LINE` + `LIVEPATCH`) is the default shipping state on enterprise ppc64le distros that offer live patching.\nPR:L - Triggering needs nothing more than invoking a syscall that reaches a livepatched function; the reproducer is an unprivileged `read()` on /proc. The livepatch itself is loaded by the administrator as routine maintenance, not as an attacker step, so the attacker only needs an ordinary local account.\nUI:N - Once a livepatch is applied \u2014 the normal steady state of a live-patched server \u2014 no victim action of any kind is required; the attacker simply calls into a patched function.\nS:U - The clobbered non-volatile register corrupts the kernel\u0027s own execution state within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The caller chain resumes with r15 silently replaced by a kernel `.text` stub address, so any function using r15 as a pointer, index, or length operates on corrupted state \u2014 on read/usercopy paths (`seq_read_iter`, `check_heap_object` in the reported trace) this can steer kernel memory into a user buffer, and the injected value itself is a live kernel text address that defeats KASLR if it reaches userspace.\nI:H - This is genuine kernel memory corruption with write effect \u2014 the reported failure is a faulting *store* to an address derived from the clobbered register, from inside `__mutex_unlock_slowpath` operating on a corrupt mutex pointer. Corrupting a callee-saved register in arbitrary kernel functions yields uncontrolled writes and corrupted locking/data structures that can be leveraged for control-flow-relevant damage.\nA:H - The demonstrated result is an immediate kernel oops (\"Unable to handle kernel data access on write\", sig 11), and because the corruption recurs on every call to a patched function it is trivially repeatable until the system panics or hangs on corrupted lock state."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:00:33.319Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a9212bf5ca640232254b31330e86272fe4073bc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb5b691f8273432297611863ac142e17119279e0"
        }
      ],
      "title": "powerpc64/ftrace: fix clobbered r15 during livepatching",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38233",
    "datePublished": "2025-07-04T13:37:46.293Z",
    "dateReserved": "2025-04-16T04:51:23.996Z",
    "dateUpdated": "2026-08-05T12:00:33.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted