CVE-2025-38067

What it actually does

The kernel fails to enforce or sanitize the rseq_cs field during rseq registration, permitting a non-zero value that may reference invalid memory and trigger a segmentation fault on return to user space.

Why it matters to the business

Affected Linux systems risk application crashes during thread creation or restartable sequence usage, especially with older glibc versions, resulting in service interruptions and operational instability across kernel-dependent workloads.

How an attack unfolds

A local attacker registers rseq with a crafted non-zero rseq_cs value that does not point to valid memory; the kernel clears the field on registration to avoid the fault but older unpatched kernels allow the invalid pointer to cause a segfault on context return.

How to fix it

Upgrade to a fixed kernel containing commit 48900d839a3454050fd5822e34be8d54c4ec9b86 or the equivalent package update such as kernel-tmb 4.1.15-2.mga5; reboot after installation.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or package version; test rseq registration paths with non-zero rseq_cs values to verify no segfault occurs.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Invoke rseq registration syscall with non-zero rseq_cs pointing to invalid address
3. Trigger return to user space to induce segmentation fault in the process

How to detect it

Search system logs and application crash reports for segmentation faults occurring shortly after thread creation or rseq-related syscalls on unpatched kernels.

What your security team should do

• Prioritize kernel updates on all production systems within standard change windows
• Review application logs for unexplained segmentation faults involving rseq or thread creation
• Test critical workloads with the patched kernel before broad deployment