GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38733 (GCVE-0-2025-38733)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:20 – Updated: 2026-08-05 12:04
VLAI
Title
s390/mm: Do not map lowcore with identity mapping
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/mm: Do not map lowcore with identity mapping Since the identity mapping is pinned to address zero the lowcore is always also mapped to address zero, this happens regardless of the relocate_lowcore command line option. If the option is specified the lowcore is mapped twice, instead of only once. This means that NULL pointer accesses will succeed instead of causing an exception (low address protection still applies, but covers only parts). To fix this never map the first two pages of physical memory with the identity mapping.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 32db401965f165f7c44447d0508097f070c8f576 , < 30bf5728bb217a6d1ba73f44094c9b9c6bc9a567 (git)
Affected: 32db401965f165f7c44447d0508097f070c8f576 , < 1d7864acd497cb468a998d44631f84896f885e85 (git)
Affected: 32db401965f165f7c44447d0508097f070c8f576 , < 93f616ff870a1fb7e84d472cad0af651b18f9f87 (git)
Affected: 0b99d0e17d6a73a0526f92bc6b54b2b95e67a31d (git)
Affected: 6.10.11 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.44 , ≤ 6.12.* (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/vmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "30bf5728bb217a6d1ba73f44094c9b9c6bc9a567",
              "status": "affected",
              "version": "32db401965f165f7c44447d0508097f070c8f576",
              "versionType": "git"
            },
            {
              "lessThan": "1d7864acd497cb468a998d44631f84896f885e85",
              "status": "affected",
              "version": "32db401965f165f7c44447d0508097f070c8f576",
              "versionType": "git"
            },
            {
              "lessThan": "93f616ff870a1fb7e84d472cad0af651b18f9f87",
              "status": "affected",
              "version": "32db401965f165f7c44447d0508097f070c8f576",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b99d0e17d6a73a0526f92bc6b54b2b95e67a31d",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/boot/vmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Do not map lowcore with identity mapping\n\nSince the identity mapping is pinned to address zero the lowcore is always\nalso mapped to address zero, this happens regardless of the relocate_lowcore\ncommand line option. If the option is specified the lowcore is mapped\ntwice, instead of only once.\n\nThis means that NULL pointer accesses will succeed instead of causing an\nexception (low address protection still applies, but covers only parts).\nTo fix this never map the first two pages of physical memory with the\nidentity mapping."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defective mapping is created by the s390 boot-time page table setup and is leveraged by triggering a kernel NULL pointer dereference, which requires the ability to execute code/syscalls on the affected system. No network protocol handler is involved in the flawed mapping itself.\nAC:L - The identity base is pinned to zero in all default (non-DEBUG_VM) builds, and the lowcore layout at virtual address 0 is a fixed, publicly documented ABI, so the read/write offsets are fully deterministic with no race or memory-layout uncertainty for the attacker to lose.\nPR:L - An ordinary unprivileged local user can reach kernel code paths containing NULL-dereference bugs (many via syscalls, ioctls, or user namespaces); no capability or administrative privilege is needed to convert those into lowcore accesses.\nUI:N - The mapping is established unconditionally at boot and the dereference is triggered directly by the attacker\u0027s own syscall; no action by any other user is required.\nS:U - The corrupted resource is the kernel\u0027s own per-CPU lowcore within the same security authority as the kernel; no hypervisor, IOMMU, or guest/host boundary is crossed.\nC:H - NULL reads now succeed and return lowcore contents, disclosing the stack canary (0x240), current_task (0x340), kernel_stack (0x348), kernel_asce (0x388), and percpu_offset (0x3b8); a large identity page at address 0 additionally exposes the first megabyte of physical memory, and hijacking user_asce or current_task escalates this to arbitrary kernel memory read.\nI:H - Writes to offsets outside low address protection\u0027s 0-511/4096-4607 windows silently corrupt return_psw (0x290), current_task (0x340), the kernel/async/nodat/mcck stack pointers, restart_fn (0x370), and kernel_asce/user_asce, giving kernel control-flow hijack and full privilege escalation instead of a fault.\nA:H - Silent corruption of the lowcore \u2014 the CPU\u0027s PSW, stack pointer, ASCE, and current-task state \u2014 produces immediate kernel panics or undefined CPU behavior, and the missing exception means faults that would have been a contained oops instead destabilize the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:23.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85"
        },
        {
          "url": "https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87"
        }
      ],
      "title": "s390/mm: Do not map lowcore with identity mapping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38733",
    "datePublished": "2025-09-05T17:20:33.075Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:23.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38733",
      "date": "2026-09-14",
      "epss": "0.00162",
      "percentile": "0.05747"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38733\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-05T18:15:42.550\",\"lastModified\":\"2026-07-30T06:23:38.537\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/mm: Do not map lowcore with identity mapping\\n\\nSince the identity mapping is pinned to address zero the lowcore is always\\nalso mapped to address zero, this happens regardless of the relocate_lowcore\\ncommand line option. If the option is specified the lowcore is mapped\\ntwice, instead of only once.\\n\\nThis means that NULL pointer accesses will succeed instead of causing an\\nexception (low address protection still applies, but covers only parts).\\nTo fix this never map the first two pages of physical memory with the\\nidentity mapping.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/s390/boot/vmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"32db401965f165f7c44447d0508097f070c8f576\",\"lessThan\":\"30bf5728bb217a6d1ba73f44094c9b9c6bc9a567\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32db401965f165f7c44447d0508097f070c8f576\",\"lessThan\":\"1d7864acd497cb468a998d44631f84896f885e85\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32db401965f165f7c44447d0508097f070c8f576\",\"lessThan\":\"93f616ff870a1fb7e84d472cad0af651b18f9f87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b99d0e17d6a73a0526f92bc6b54b2b95e67a31d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.10.11\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/s390/boot/vmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.44\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.4\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.11\",\"versionEndExcluding\":\"6.11\",\"matchCriteriaId\":\"AE0F2E18-08FB-405F-82A3-EAD7810E842D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11.1\",\"versionEndExcluding\":\"6.12.44\",\"matchCriteriaId\":\"B4D50845-A441-49B4-934F-FC9AE00C40F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.4\",\"matchCriteriaId\":\"AFC28995-B8C3-4B68-8CB6-78E792B6629D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"4770BA57-3F3F-493B-8608-EC3B25254949\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE5298B3-04B4-4F3E-B186-01A58B5C75A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d7864acd497cb468a998d44631f84896f885e85\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/30bf5728bb217a6d1ba73f44094c9b9c6bc9a567\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/93f616ff870a1fb7e84d472cad0af651b18f9f87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:08:51+00:00",
      "cve": "CVE-2025-38733",
      "id": "CVE-2025-38733",
      "initial_release_date": "2025-09-05T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service due to incorrect lowcore memory mapping",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38733.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:59:29Z",
      "cve": "CVE-2025-38733",
      "id": "CVE-2025-38733",
      "initial_release_date": "2025-09-05T23:23:26Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "72",
      "product_status:known_not_affected": "475",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38733",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38733.json",
      "version": "32"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.