PT-2025-34398 · Linux+2 · Linux Kernel+2

Published 2025-01-01 · Updated 2026-04-20 · CVE-2025-38636

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The Linux kernel contains an issue where DA monitors tracepoints, when used with KASAN enabled, can trigger a global-out-of-bounds read due to reading 32 bytes as an array instead of a string from the automata definition. This occurs because the tracepoints read beyond the intended string literals, potentially accessing memory belonging to adjacent automata data. While the error is considered harmless as the printing process stops at the null terminator, it still represents a memory access issue. The root cause is the improper handling of string data within the tracepoints.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-66611

BDU:2026-03064

CVE-2025-38636

ECHO-6475-85A2-99C9

Affected Products

Astra Linux

Debian

Linux Kernel

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38636.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-38636 · Security Note
• https://osv.dev/vulnerability/CVE-2025-38636 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-38636 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-38636 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-38636 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-38636 · Security Note
• https://osv.dev/vulnerability/AZL-66611 · Vendor Advisory
• https://git.kernel.org/stable/c/7f904ff6e58d398c4336f3c19c42b338324451f7 · Patch
• https://git.kernel.org/stable/c/0ebc70d973ce7a81826b5c4f55f743e07f5864d9 · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-38636 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03064 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-38636 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38636 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2025-38636 · Vendor Advisory