Cloudanix VulnDB

CVE-2025-38688

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel could let a program trick the system into mixing up memory areas it should keep separate, opening the door to unexpected access or crashes.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

ALIGN() overflow during IOVA allocation in iommufd can wrap near ULONG_MAX, producing a corrupted IOVA that permits userspace mappings to overlap other mappings or reserved ranges, resulting in memory corruption.

Why it matters to the business

In Linux kernel deployments, especially those supporting virtualization or containers, this flaw risks unauthorized memory access or system instability; with 418 days since disclosure and low EPSS the immediate risk is modest but still requires attention on affected stable kernels.

How an attack unfolds

An attacker with userspace access submits an IOVA allocation request crafted near ULONG_MAX; the ALIGN() operation wraps, the kernel accepts an overlapping range, and the resulting corrupted mapping can be leveraged for further memory corruption or privilege escalation similar to other recent kernel IOVA-related issues.

How to fix it

Update the Linux kernel to the commit d19b817540c0abe84854a64ee9ee34cecc3bbeef or later stable releases that consolidate the overflow-safe helper; rebuild and reboot all affected nodes.

How to confirm the fix worked

Verify the presence of the get_add_overflow-based helper and absence of the original ALIGN() path in iommufd source; confirm kernel build contains d19b817540c0abe84854a64ee9ee34cecc3bbeef and test IOVA allocation near boundary values.

Typical attack path

  1. Obtain unprivileged userspace access on a system using iommufd
  2. Craft and submit an IOVA allocation request positioned near ULONG_MAX
  3. Trigger ALIGN() wrap to obtain a corrupted overlapping IOVA
  4. Use the overlapping mapping to corrupt or access adjacent memory regions

How to detect it

Inspect kernel logs and IOMMU-related traces for unusual allocation requests or mapping overlap warnings; correlate with process activity that exercises iommufd interfaces.

What your security team should do

  • Apply the referenced kernel commit immediately on all production systems
  • Prioritize patching for container hosts and IOMMU-enabled workloads
  • Monitor for new stable kernel releases containing the fix
  • Review downstream package maintainers for backported updates

The record

In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length earlier either. Consolidate the two copies of this code under a single helper. This bug would allow userspace to create a mapping that overlaps with some other mapping or a reserved range.

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 linux 0 6.12.43-1
Debian:14 linux 0 6.16.3-1
Linux Kernel 6.2.0 6.6.103
Mageia:9 kernel 0 6.6.105-1.mga9
Mageia:9 kernel-linus 0 6.6.105-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.10-10.mga9
Mageia:9 kmod-xtables-addons 0 3.24-86.mga9
Mageia:9 mageia-repos 0 9-4.mga9
Mageia:9 meta-task 0 9-4.mga9

Related vulnerabilities