PT-2025-35962 · Linux+1 · Linux Kernel+1

Published 2025-08-11 · Updated 2026-05-26 · CVE-2025-38689

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw where reading /proc/[kthread]/arch status can cause a NULL pointer dereference when CONFIG X86 DEBUG FPU is enabled. This occurs because the AVX-512 timestamp code uses x86 task fpu() without checking for NULL, and CONFIG X86 DEBUG FPU can cause this function to return NULL for kernel threads. The issue arises from attempting to output AVX-512 elapsed milliseconds for kernel threads, which is unreliable as avx512 timestamp is only updated for user threads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-02861

CVE-2025-38689

Affected Products

Astra Linux

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38689.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-38689 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38689 · Vendor Advisory
• https://git.kernel.org/stable/c/2ca887e81095b99d890a8878841f36f4920181e6 · Patch
• https://bdu.fstec.ru/vul/2026-02861 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38689 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2025-38689 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2025-38689 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-38689 · Security Note
• https://git.kernel.org/stable/c/31cd31c9e17ece125aad27259501a2af69ccb020 · Patch
• https://ubuntu.com/security/CVE-2025-38689 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2025090448-CVE-2025-38689-ac95@gregkh · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1963644652965253555 · Twitter Post
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.2 · Note