CVE-2025-38689

{
  "id": "CVE-2025-38689",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-09-04T16:15:37.013",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Fix NULL dereference in avx512_status()\n\nProblem\n-------\nWith CONFIG_X86_DEBUG_FPU enabled, reading /proc/[kthread]/arch_status\ncauses a warning and a NULL pointer dereference.\n\nThis is because the AVX-512 timestamp code uses x86_task_fpu() but\ndoesn't check it for NULL. CONFIG_X86_DEBUG_FPU addles that function\nfor kernel threads (PF_KTHREAD specifically), making it return NULL.\n\nThe point of the warning was to ensure that kernel threads only access\ntask->fpu after going through kernel_fpu_begin()/_end(). Note: all\nkernel tasks exposed in /proc have a valid task->fpu.\n\nSolution\n--------\nOne option is to silence the warning and check for NULL from\nx86_task_fpu(). However, that warning is fairly fresh and seems like a\ndefense against misuse of the FPU state in kernel threads.\n\nInstead, stop outputting AVX-512_elapsed_ms for kernel threads\naltogether. The data was garbage anyway because avx512_timestamp is\nonly updated for user threads, not kernel threads.\n\nIf anyone ever wants to track kernel thread AVX-512 use, they can come\nback later and do it properly, separate from this bug fix.\n\n[ dhansen: mostly rewrite changelog ]"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nx86/fpu: Corrige la desreferencia de NULL en avx512_status()\n\nProblema\n-------\nCon CONFIG_X86_DEBUG_FPU habilitado, la lectura de /proc/[kthread]/arch_status causa una advertencia y una desreferencia de puntero NULL.\n\nEsto se debe a que el código de marca de tiempo AVX-512 usa x86_task_fpu() pero no lo verifica en busca de NULL. CONFIG_X86_DEBUG_FPU confunde esa función para los hilos del kernel (específicamente PF_KTHREAD), haciendo que devuelva NULL.\n\nEl propósito de la advertencia era asegurar que los hilos del kernel solo accedieran a task->fpu después de pasar por kernel_fpu_begin()/_end(). Nota: todas las tareas del kernel expuestas en /proc tienen un task->fpu válido.\n\nSolución\n--------\nUna opción es silenciar la advertencia y verificar si hay NULL desde x86_task_fpu(). Sin embargo, esa advertencia es bastante reciente y parece una defensa contra el uso indebido del estado de la FPU en los hilos del kernel.\n\nEn su lugar, se deja de emitir AVX-512_elapsed_ms para los hilos del kernel por completo. Los datos eran basura de todos modos porque avx512_timestamp solo se actualiza para los hilos de usuario, no para los hilos del kernel.\n\nSi alguien alguna vez quiere rastrear el uso de AVX-512 en hilos del kernel, puede volver más tarde y hacerlo correctamente, por separado de esta corrección de errores.\n\n[ dhansen: reescritura mayoritaria del registro de cambios ]"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "arch/x86/kernel/fpu/xstate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "22aafe3bcb67472effdea1ccf0df20280192bbaf",
              "lessThan": "2ca887e81095b99d890a8878841f36f4920181e6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "22aafe3bcb67472effdea1ccf0df20280192bbaf",
              "lessThan": "31cd31c9e17ece125aad27259501a2af69ccb020",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "arch/x86/kernel/fpu/xstate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.16",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.16.2",
              "lessThanOrEqual": "6.16.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.16",
              "versionEndExcluding": "6.16.2",
              "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2ca887e81095b99d890a8878841f36f4920181e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/31cd31c9e17ece125aad27259501a2af69ccb020",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}