Junglewise Threat Intelligence

CVE-2025-38067: Linux Kernel segmentation fault in rseq registration

CVE-2025-38067 · Severity: medium · CVSS 5.5 · Published 2025-06-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Restartable Sequences (rseq) subsystem could allow a local user to cause a system crash (segmentation fault). The issue occurs because the kernel does not properly validate or clear certain memory fields during thread registration, particularly when using older versions of the standard C library (glibc). This primarily impacts system stability and availability.

Technical details

A vulnerability exists in the Linux kernel's rseq (Restartable Sequences) registration logic. The 'rseq_cs' field, which should be initialized to zero by userspace, is not enforced or cleared by the kernel during the rseq syscall. If a process (such as one using an older glibc version that reuses rseq areas) leaves a non-zero, invalid pointer in this field, the kernel may attempt to access it upon return to userspace, resulting in a segmentation fault. The fix involves explicitly clearing the rseq_cs field during registration if it is found to be non-zero, ensuring compatibility with legacy library behaviors while preventing the crash.

Affected products

  • Linux Linux Kernel 4.18 to 5.10.240, 5.11 to 5.15.189, 5.16 to 6.1.146, 6.2 to 6.6.99, 6.7 to 6.12.39, 6.13 to 6.14.9

Timeline

  • 2025-03-06: other: Patch authored
  • 2025-06-18: disclosed: CVE published

References

Related threats