CVE-2025-38068

What it actually does

The LZO compression implementation in the Linux kernel crypto subsystem writes beyond the end of the caller-supplied output buffer because it never validates remaining space before each write, unlike the decompression path.

Why it matters to the business

Kernel memory corruption can occur on systems performing LZO compression through the crypto API, potentially leading to crashes, denial of service, or local privilege escalation on unpatched Linux distributions and virtual machine guest additions.

How an attack unfolds

An attacker with the ability to trigger kernel crypto compression (for example via crafted network packets, file system operations, or userspace interfaces) supplies input that causes the unsafe LZO routine to overrun its output buffer, corrupting adjacent kernel memory and enabling further exploitation.

How to fix it

Update the Linux kernel to a version containing commit 4b173bb2c4665c23f8fcf5241c7b06dfa6b5b111 or apply the equivalent stable backport. For Mageia 5 systems, upgrade kmod-vboxadditions, kmod-virtualbox, and virtualbox packages to version 5.0.14-1.mga5 or later.

How to confirm the fix worked

Verify the running kernel contains the safe LZO compression interface (check for the presence of the commit or test that compression now respects the supplied output length parameter). Confirm package versions on Mageia systems match the fixed releases.

Typical attack path

1. Identify a code path that invokes the LZO compression interface with attacker-controlled data
2. Craft input that exceeds the assumed output buffer size
3. Trigger compression to perform unchecked writes past the buffer end
4. Corrupt kernel memory structures to achieve code execution or denial of service

How to detect it

Review kernel logs for unexpected oops or panic messages during crypto compression operations; inspect process and module activity around virtualbox or vboxadditions drivers on affected distributions.

What your security team should do

• Prioritize kernel updates on all systems that expose the crypto LZO interface, especially those running affected Mageia packages
• Monitor EPSS and threat actor activity for any increase in exploit maturity
• Apply the fixed commit or package versions listed for each affected product
• Reboot systems after kernel updates and validate with regression tests on crypto compression workloads