PT-2025-28880 · Linux+1 · Linux Kernel+1

Anubis · Published 2025-07-09 · Updated 2025-07-09 · CVE-2025-38252

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The cxl cper handle prot err() function makes assumptions about the type and binding of devices identified in records, potentially leading to crashes. Specifically, the function incorrectly assumes endpoints are CXL-type-3 devices and bound to the cxl pci driver. The code has been corrected to verify that the PCIe endpoint parents a cxl memdev before assuming the driver data format, preparing the implementation for CXL accelerators not bound to cxl pci.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2025-13464

CVE-2025-38252

Affected Products

Astra Linux

Linux Kernel

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38252.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-38252 · Security Note
• https://git.kernel.org/stable/c/3c70ec71abdaf4e4fa48cd8fdfbbd864d78235a8 · Patch
• https://osv.dev/vulnerability/CVE-2025-38252 · Vendor Advisory
• https://git.kernel.org/stable/c/4bcb8dd36e9e3fad6c22862ac5b6993df838309b · Patch
• https://cve.org/CVERecord?id=CVE-2025-38252 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38252 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38252 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13464 · Security Note
• https://git.kernel.org/linus/3c70ec71abdaf4e4fa48cd8fdfbbd864d78235a8 · Note
• https://twitter.com/CVEnew/status/1942924441849344128 · Twitter Post
• https://lore.kernel.org/linux-cve-announce/2025070935-CVE-2025-38252-41d6@gregkh · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note