PT-2025-33565 · Linux+1 · Linux Kernel+1

Published 2025-07-16 · Updated 2025-08-16 · CVE-2025-38522

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux Kernel (affected versions not specified)

Description: The Linux kernel contains a flaw within the scheduler extension (sched/ext) related to calls to the update locked rq() function with a NULL runqueue (rq) pointer. Invoking update locked rq(NULL) with preemption enabled could trigger a bug warning due to the unsafe use of this cpu write() in a preemptible context. This occurs when rq is NULL during operations invoked from an unlocked context. The issue is resolved by ensuring that update locked rq() is only called when rq is not NULL, preventing the problematic call to this cpu write().

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

BDU:2026-03109

CVE-2025-38522

Affected Products

Astra Linux

Linux Kernel

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38522.json · Exploit
• https://git.kernel.org/stable/c/237c43037b336e36a49eb9f2daac1c7719ec7f8b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38522 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38522 · Vendor Advisory
• https://git.kernel.org/stable/c/e14fd98c6d66cb76694b12c05768e4f9e8c95664 · Patch
• https://cve.org/CVERecord?id=CVE-2025-38522 · Security Note
• https://osv.dev/vulnerability/CVE-2025-38522 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38522 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03109 · Security Note
• https://twitter.com/VulmonFeeds/status/1956847530353783087 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://t.me/cveNotify/132581 · Telegram Post
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.8 · Note
• https://lore.kernel.org/linux-cve-announce/2025081652-CVE-2025-38522-641c@gregkh · Note
• https://git.kernel.org/linus/e14fd98c6d66cb76694b12c05768e4f9e8c95664 · Note