CVE-2025-38033

None

CVSS

—

EPSS

0.2%

Published

Jun 18, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A configuration mistake in the Linux kernel could cause systems that use the Rust programming language to crash when an extra security feature was turned on.

Exploitation: Local Privilege
Attacker needs: Local User
Complexity: Low
Impact: Denial Of Service
Component: OS kernel
Class: Misconfiguration
Remediation: Config Change
Effort: Low
Patch risk: Low

What it actually does

The Kconfig dependency for CFI_AUTO_DEFAULT did not account for Rust, allowing FineIBT to be enabled by default; core::fmt::write and related fmt functions in the Rust core library lack CFI instrumentation, causing Control Protection exceptions and kernel panics when called under FineIBT.

Why it matters to the business

Organizations building or running Linux kernels with Rust support cannot safely enable FineIBT by default, leaving systems without a key control-flow integrity defense until the configuration is corrected or a newer Rust toolchain is used.

How an attack unfolds

An attacker with the ability to trigger Rust code paths that invoke core::fmt (for example via a user-space program exercising Rust kernel modules or drivers) causes the kernel to execute a non-CFI-protected function after FineIBT has removed the endbr64 instruction, resulting in an immediate invalid-opcode panic.

How to fix it

Apply the upstream commit 5a8d073d87da4ad1496b35adaee5719e94665d81 or later; ensure the kernel Kconfig enforces CFI_AUTO_DEFAULT depends on !RUST or Rust >= 1.88; rebuild and deploy the corrected kernel image.

How to confirm the fix worked

Inspect .config after menuconfig to confirm CFI_AUTO_DEFAULT is disabled when Rust is selected and Rust version < 1.88; attempt to build and boot with both options enabled and verify absence of the do_kernel_cp_fault panic.

Typical attack path

Identify a kernel build with both CONFIG_RUST and FineIBT/CFI enabled
Trigger execution of Rust code that reaches core::fmt::write or Argument::fmt
Kernel performs an indirect branch to a function whose endbr64 was sealed by FineIBT
CPU raises a Control Protection exception, producing a kernel BUG and panic

How to detect it

Search kernel logs and crash dumps for the strings 'kernel BUG at arch/x86/kernel/cet.c', 'do_kernel_cp_fault', '_RNvXs5_NtNtNtCs3o2tGsuHyou_4core3fmt', and 'invalid opcode' combined with Rust-related tainted modules or dmabuf_dump processes.

kernel BUG at arch/x86/kernel/cet.c:132
do_kernel_cp_fault+0xea/0xf0
_RNvXs5_NtNtNtCs3o2tGsuHyou_4core3fmt3num3impyNtB9_7Display3fmt
Tainted: G U O
RIP: 0010:_RNvNtCs3o2tGsuHyou_4core3fmt5write

What your security team should do

Immediately verify whether any production kernels enable both Rust and FineIBT/CFI
Schedule upgrade to a kernel containing commit 5a8d073d87da4ad1496b35adaee5719e94665d81
Add build-time checks that prevent simultaneous enabling of Rust and FineIBT until Rust 1.88+ is in use
Monitor kernel build pipelines for future regressions once objtool CFI checks land in Rust CI

The record

In the Linux kernel, the following vulnerability has been resolved: x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 Calling core::fmt::write() from rust code while FineIBT is enabled results in a kernel panic: [ 4614.199779] kernel BUG at arch/x86/kernel/cet.c:132! [ 4614.205343] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 4614.211781] CPU: 2 UID: 0 PID: 6057 Comm: dmabuf_dump Tainted: G U O 6.12.17-android16-0-g6ab38c534a43 #1 9da040f27673ec3945e23b998a0f8bd64c846599 [ 4614.227832] Tainted: [U]=USER, [O]=OOT_MODULE [ 4614.241247] RIP: 0010:do_kernel_cp_fault+0xea/0xf0 ... [ 4614.398144] RIP: 0010:_RNvXs5_NtNtNtCs3o2tGsuHyou_4core3fmt3num3impyNtB9_7Display3fmt+0x0/0x20 [ 4614.407792] Code: 48 f7 df 48 0f 48 f9 48 89 f2 89 c6 5d e9 18 fd ff ff 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 41 81 ea 14 61 af 2c 74 03 0f 0b 90 <66> 0f 1f 00 55 48 89 e5 48 89 f2 48 8b 3f be 01 00 00 00 5d e9 e7 [ 4614.428775] RSP: 0018:ffffb95acfa4ba68 EFLAGS: 00010246 [ 4614.434609] RAX: 0000000000000000 RBX: 0000000000000010 RCX: 0000000000000000 [ 4614.442587] RDX: 0000000000000007 RSI: ffffb95acfa4ba70 RDI: ffffb95acfa4bc88 [ 4614.450557] RBP: ffffb95acfa4bae0 R08: ffff0a00ffffff05 R09: 0000000000000070 [ 4614.458527] R10: 0000000000000000 R11: ffffffffab67eaf0 R12: ffffb95acfa4bcc8 [ 4614.466493] R13: ffffffffac5d50f0 R14: 0000000000000000 R15: 0000000000000000 [ 4614.474473] ? __cfi__RNvXs5_NtNtNtCs3o2tGsuHyou_4core3fmt3num3impyNtB9_7Display3fmt+0x10/0x10 [ 4614.484118] ? _RNvNtCs3o2tGsuHyou_4core3fmt5write+0x1d2/0x250 This happens because core::fmt::write() calls core::fmt::rt::Argument::fmt(), which currently has CFI disabled: library/core/src/fmt/rt.rs: 171 // FIXME: Transmuting formatter in new and indirectly branching to/calling 172 // it here is an explicit CFI violation. 173 #[allow(inline_no_sanitize)] 174 #[no_sanitize(cfi, kcfi)] 175 #[inline] 176 pub(super) unsafe fn fmt(&self, f: &mut Formatter<'_>) -> Result { This causes a Control Protection exception, because FineIBT has sealed off the original function's endbr64. This makes rust currently incompatible with FineIBT. Add a Kconfig dependency that prevents FineIBT from getting turned on by default if rust is enabled. [ Rust 1.88.0 (scheduled for 2025-06-26) should have this fixed [1], and thus we relaxed the condition with Rust >= 1.88. When `objtool` lands checking for this with e.g. [2], the plan is to ideally run that in upstream Rust's CI to prevent regressions early [3], since we do not control `core`'s source code. Alice tested the Rust PR backported to an older compiler. Peter would like that Rust provides a stable `core` which can be pulled into the kernel: "Relying on that much out of tree code is 'unfortunate'". - Miguel ] [ Reduced splat. - Miguel ]

Affected packages

Ecosystem	Package	Introduced	Fixed
Debian:13	linux	0	6.12.32-1
Linux	Kernel	6.11.0	6.12.31