CVE-2025-38100

What it actually does

NULL pointer dereference in tss_update_io_bitmap() triggered by inconsistent TIF_IO_BITMAP state during io_bitmap_exit() on non-current tasks or after thread flag copying in copy_thread() without bitmap inheritance.

Why it matters to the business

Linux systems may experience kernel crashes and service interruptions during process creation or thread management in affected kernels, leading to downtime and potential loss of availability until patched.

How an attack unfolds

An attacker with local access triggers thread creation or failed fork scenarios that copy TIF_IO_BITMAP flags without proper bitmap setup, causing the kernel to dereference a null pointer when updating TSS I/O bitmaps; listed threat actors and campaigns demonstrate similar kernel privilege patterns but this flaw primarily yields denial of service rather than code execution.

How to fix it

Update Linux kernel to a version containing commit d64b7b05a827f98d068f412969eef65489b0cf03 or later; for Chainguard packages update cass-operator-fips and cass-operator-compat-fips to 1.24.0-r1; rebuild and reboot systems with fixed kernels; apply vendor patches promptly given the 481 days since publication.

How to confirm the fix worked

Verify kernel source contains the added checks preventing task_update_io_bitmap() on non-current tasks and unconditional TIF_IO_BITMAP clearing in copy_thread(); confirm no NULL dereference warnings in tss_update_io_bitmap(); test with fork failure and kernel thread creation workloads.

Typical attack path

1. Obtain local user access on an unpatched Linux system
2. Perform operations that invoke copy_thread() or exit_thread() on tasks with inherited thread flags
3. Force inconsistent TIF_IO_BITMAP state without bitmap allocation
4. Trigger tss_update_io_bitmap() to induce NULL dereference and crash

How to detect it

Inspect kernel logs for NULL pointer dereference crashes in tss_update_io_bitmap or io_bitmap_exit paths; correlate with process creation or fork failure events; review threat actor activity around similar kernel privilege escalations for context.

What your security team should do

• Prioritize kernel updates on all x86 Linux systems within standard maintenance windows
• Monitor for kernel oops or panic logs related to io_bitmap and tss_update
• Review downstream package dependencies for affected Chainguard images and schedule upgrades
• Limit local untrusted code execution until patches are deployed