PT-2025-28889 · Linux+3 · Linux Kernel+3

Published 2025-07-09 · Updated 2026-04-20 · CVE-2025-38261

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions:

Linux kernel versions 5.12.0-rc2-syzkaller-00467-g0d7588ab9ef9 and earlier.

Description:

A flaw exists in the Linux kernel's task switching routine on RISC-V architecture. Specifically, the issue relates to the handling of the SR SUM status during thread/task switching. Without proper saving and restoring of the SR SUM state, crashes can occur, particularly under heavy load conditions, such as those generated by the syz-stress tool. The root cause is related to the put user() macro within the schedule tail() function, which could lead to a panic when interacting with sleeping functions.

Recommendations:

Linux kernel versions prior to 5.12.0-rc2-syzkaller-00467-g0d7588ab9ef9 should be updated.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2025-13468

CVE-2025-38261

ECHO-1563-A367-496F

USN-7833-1

USN-7833-2

USN-7833-3

USN-7833-4

USN-7834-1

USN-7856-1

Affected Products

Debian

Linuxmint

Linux Kernel

Ubuntu

References · 215

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38261.json · Exploit
• https://ubuntu.com/security/CVE-2025-38191 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38229 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38324 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38434 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38188 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38086 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13468 · Security Note
• https://ubuntu.com/security/CVE-2025-38426 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7856-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38090 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38241 · Vendor Advisory
• https://git.kernel.org/stable/c/788aa64c01f1262310b4c1fb827a36df170d86ea · Patch
• https://ubuntu.com/security/CVE-2025-38219 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38343 · Vendor Advisory