CVE-2025-38559

What it actually does

NULL pointer dereference in intel_pmt_read() when crashlog sysfs endpoint is accessed without a valid pcidev pointer, leading to kernel oops during sysfs binary read operations.

Why it matters to the business

Kernel panic or system crash on affected Linux systems when crashlog sysfs interfaces are read, causing unplanned downtime and potential data loss in environments using Intel PMT crashlog functionality.

How an attack unfolds

An attacker with local access triggers the vulnerable code path by performing a read on the crashlog binary sysfs attribute; the missing pcidev pointer results in a NULL dereference during intel_pmt_read, crashing the kernel.

How to fix it

Update the Linux kernel to commit 860d93bd6a21f08883711196344c353bc3936a2b or later; for Chainguard packages upgrade openjdk-8-openj9, openjdk-8-openj9-dbg, openjdk-8-openj9-default-jdk, openjdk-8-openj9-default-jvm, openjdk-8-openj9-doc, and openjdk-8-openj9-jre to version 0.53.0-r1 or newer.

How to confirm the fix worked

Verify kernel version contains commit 860d93bd6a21f08883711196344c353bc3936a2b; confirm Chainguard package versions are at or above 0.53.0-r1; attempt to read the crashlog sysfs binary attribute and ensure no NULL dereference occurs.

Typical attack path

1. Obtain local shell or process execution on target system
2. Locate and read the crashlog binary sysfs file exposed by the pmt_class module
3. Trigger intel_pmt_read() without a valid pcidev context
4. Cause NULL pointer dereference and kernel oops

How to detect it

Search kernel logs for Oops messages containing intel_pmt_read and sysfs_kf_bin_read; inspect dmesg or journalctl for NULL pointer dereference at address 0000000000000000 originating from pmt_class module.

• BUG: kernel NULL pointer dereference, address: 0000000000000000
• RIP: 0010:intel_pmt_read+0x3b/0x70 [pmt_class]
• sysfs_kf_bin_read+0xc0/0xe0

What your security team should do

• Prioritize kernel and listed package upgrades within patch windows due to memory corruption class
• Audit systems for presence of intel_pmt crashlog sysfs entries
• Monitor for kernel oops logs matching the described RIP and call trace
• Apply updates before any scheduled maintenance that exercises PMT interfaces