CVE-2025-38008

What it actually does

Race condition in Linux kernel page allocator static_branch_inc/dec tracking of zones with unaccepted memory allows unsynchronized operations that trigger WARN in jump_label.c during concurrent add/remove of unaccepted pages.

Why it matters to the business

May produce kernel warnings or minor performance effects on systems using unaccepted memory; widespread Linux kernel exposure increases patching urgency across servers and containers.

How an attack unfolds

An attacker triggers concurrent page allocation and unaccepted memory operations to hit the unsynchronized static branch state, surfacing the ordering issue noted in the static key machinery; related kernel privilege issues in Container-Optimized OS have been exploited by listed threat actors but this specific race shows no active exploitation.

How to fix it

Upgrade the Linux kernel to commit 98fdd2f612e949c652693f6df00442c81037776d or later; for cups-filters on Mageia 5 update to 1.0.71-1.1.mga5.

How to confirm the fix worked

Verify running kernel contains the fix commit; confirm absence of the __static_key_slow_dec_cpuslocked warning in dmesg under memory pressure tests.

Typical attack path

1. Locate Linux system handling unaccepted memory
2. Induce concurrent zone updates via memory pressure or allocation patterns
3. Trigger static_branch decrement concurrent with increment to hit warning path

How to detect it

Search kernel logs and dmesg for the exact static_key_slow_dec_cpuslocked warning string and associated jump_label.c line numbers indicating concurrent increment/decrement attempts.

• WARNING: CPU: .* PID: .* at kernel/jump_label.c:276 __static_key_slow_dec_cpuslocked+0x8e/0xa0
• __static_key_slow_dec_cpuslocked
• static_branch_enc/dec

What your security team should do

• Prioritize kernel upgrade on all affected hosts due to 496 days since publication
• Scan for the static key warning in centralized logs
• Test memory allocation workloads post-update to validate microbenchmark behavior