CVE-2025-38676

What it actually does

The flaw is a one-byte stack buffer overflow in AMD IOMMU command-line parsing of the acpiid parameter when the input string reaches maximum length, allowing adjacent stack memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can achieve kernel-level memory corruption leading to crashes, privilege escalation, or system compromise; the low EPSS and lack of KEV listing indicate limited in-the-wild exploitation but the 427-day exposure window still requires urgent patching on any remaining unpatched kernels.

How an attack unfolds

An attacker with local access supplies a maximum-length acpiid string via the kernel command line; the missing length check writes one byte past the acpiid buffer, corrupting the stack and enabling control-flow hijacking or denial of service. Threat actors such as VMSCAPE and campaigns around CVE-2024-58240 and CVE-2025-39682 demonstrate ongoing interest in similar Linux kernel privilege-escalation primitives.

How to fix it

Upgrade the Linux kernel to a version containing the fix (commit 627337d95bee7dd8d4690238a35fffd35072d1fa or later equivalent backport); rebuild initramfs/bootloader configuration and reboot. Where immediate patching is impossible, restrict untrusted local access and consider kernel command-line hardening.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or later; inspect /proc/cmdline handling code for the length guard on acpiid; run automated vulnerability scanners against the exact kernel version and verify no remaining acpiid overflow path exists.

Typical attack path

1. Obtain local shell or execution context on target system
2. Modify kernel command line (e.g., via bootloader configuration) to include an acpiid string of maximum length
3. Trigger IOMMU initialization or early boot path that parses the parameter
4. Exploit the resulting one-byte overflow for arbitrary code execution or crash

How to detect it

Review kernel logs and bootloader configuration files for unusually long acpiid values; inspect dmesg or journalctl output around IOMMU initialization for stack-related warnings or crashes; correlate with process execution of bootloader tools or kernel module loads.

What your security team should do

• Prioritize kernel updates on all AMD IOMMU-enabled systems within the next maintenance window
• Audit bootloader configurations for overly long or crafted acpiid parameters
• Enable kernel stack canaries and address-space layout randomization if not already active
• Monitor EPSS trend and threat-actor activity around related Linux kernel CVEs for potential increase in targeting