CVE-2025-38733CWE-476

CVE-2025-38733

High · published September 5, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

s390/mm: Do not map lowcore with identity mapping

Since the identity mapping is pinned to address zero the lowcore is always

also mapped to address zero, this happens regardless of the relocate_lowcore

command line option. If the option is specified the lowcore is mapped

twice, instead of only once.

This means that NULL pointer accesses will succeed instead of causing an

exception (low address protection still applies, but covers only parts).

To fix this never map the first two pages of physical memory with the

identity mapping.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.5th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-09-05T22:15Z
Affected products (9)
ProductVersionsFixed in
linux/linux_kernel≥ 6.10.11, < 6.116.11
linux/linux_kernel≥ 6.11.1, < 6.12.446.12.44
linux/linux_kernel≥ 6.13, < 6.16.46.16.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
EPSS history
Timeline
  • 05 SEP 17:20Z
    s390/mm: Do not map lowcore with identity mapping
    cvelistv5