CVE-2025-38071

MEDIUM

Linux Kernel < 6.1.141 - Denial of Service via memblock_phys_alloc_range Failure

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Check return value from memblock_phys_alloc_range() At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblock_phys_alloc_range() returns 0 on failure, which leads memblock_phys_free() to throw the first 4 MiB of physical memory to the wolves. At a minimum it should fail gracefully with a meaningful diagnostic, but in fact everything seems to work fine without the weird reserve allocation.

Scores

CVSS v3 5.5
EPSS 0.0008
EPSS Percentile 23.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (18)
debian/debian_linux 11.0
linux/Kernel 5.15.0 - 6.1.141linux
linux/Kernel 6.13.0 - 6.14.9linux
linux/Kernel 6.2.0 - 6.6.93linux
linux/Kernel 6.7.0 - 6.12.31linux
Linux/Linux < 5.15
Linux/Linux 5.15
Linux/Linux 6.1.141 - 6.1.*
Linux/Linux 6.12.31 - 6.12.*
Linux/Linux 6.14.9 - 6.14.*
... and 8 more
Published Jun 18, 2025
Tracked Since Feb 18, 2026