CVE-2025-38733

What it actually does

The kernel identity mapping on s390 inadvertently maps the first two physical pages (including the lowcore) to address zero regardless of the relocate_lowcore option, allowing certain NULL pointer accesses to succeed instead of faulting.

Why it matters to the business

On s390 systems running affected kernels, memory safety checks that rely on NULL dereference faults can be bypassed, increasing risk of kernel instability, crashes, or memory corruption issues in production workloads.

How an attack unfolds

An attacker with the ability to trigger a NULL pointer dereference in kernel code on an s390 system can have the access succeed due to the unintended lowcore mapping, potentially allowing further corruption or control-flow manipulation before low-address protection intervenes.

How to fix it

Upgrade the Linux kernel to a version containing commit 30bf5728bb217a6d1ba73f44094c9b9c6bc9a567 or later; for affected container images update to the 18.3.1-r0 releases that incorporate the fixed kernel.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is at the patched version; verify that the first two physical pages are no longer identity-mapped by inspecting the kernel page tables or boot logs on s390 hardware.

Typical attack path

1. Identify or trigger a NULL pointer dereference path in kernel code running on s390
2. Rely on the identity mapping to make the access succeed at virtual address zero
3. Proceed with subsequent memory operations or corruption that would otherwise have been blocked by a fault

How to detect it

Examine kernel boot logs and page-table dumps on s390 hosts for evidence of lowcore identity mapping; look for unexpected successful accesses to low virtual addresses in kernel oops or fault records.

What your security team should do

• Prioritize kernel upgrades on all s390 systems within the next maintenance window
• Review s390-specific kernel configurations for any use of relocate_lowcore
• Monitor for downstream package updates in container images and rebuild pipelines