CVE-2025-38681

What it actually does

Race condition in ptdump_walk_pgd() and ptdump_check_wx() allows concurrent memory hot-remove to free intermediate kernel page table levels while the dump code still holds references, resulting in use-after-free and potential dereference of invalid addresses.

Why it matters to the business

Local users on affected Linux systems may trigger kernel instability or crashes when accessing debug interfaces for page table inspection; low exploitation likelihood and no ransomware usage reduce immediate operational risk, though kernel updates remain necessary for long-term stability.

How an attack unfolds

An attacker with local access triggers concurrent memory hot-remove while reading /sys/kernel/debug/kernel_page_tables or check_wx_pages; the missing hotplug lock lets freed page table memory be reused, causing the dump routines to follow invalid pointers and potentially crash the system. Named actors such as VMSCAPE have been associated with similar Linux kernel privilege-escalation activity on container-optimized environments.

How to fix it

Upgrade the Linux kernel to commit 3ee9a8c27bfd72c3f465004fa8455785d61be5e8 or later; for MinimOS packages update keycloak and keycloak-doc to 26.3.3-r0. Reboot after kernel updates and verify the memory hotplug lock is now acquired inside the generic ptdump functions.

How to confirm the fix worked

Confirm the presence of the memory hotplug lock acquisition inside ptdump_check_wx() and ptdump_walk_pgd(); test concurrent memory hot-remove while reading the debugfs interfaces and verify no use-after-free or inconsistent page table output occurs.

Typical attack path

1. Obtain local unprivileged access to a vulnerable Linux system
2. Trigger memory hot-remove operations while simultaneously accessing kernel_page_tables debug interfaces
3. Exploit resulting use-after-free in page table walker to induce kernel panic or instability

How to detect it

Review kernel logs for page table walker oops or use-after-free reports occurring concurrently with memory hot-remove events; inspect access timestamps on /sys/kernel/debug/kernel_page_tables and check_wx_pages during hotplug activity.

What your security team should do

• Prioritize kernel updates on systems exposing /sys/kernel/debug/kernel_page_tables to untrusted local users
• Monitor EPSS and threat actor activity for any rise in exploitation of this or related Linux kernel page-table CVEs
• Apply the fixed commit or package versions within standard change windows; no emergency KEV deadline applies