CVE-2025-38071 — Incorrect Check of Function Return Value in Linux
Severity
5.5MEDIUMNVD
OSV3.2
EPSS
0.1%
top 76.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 18
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Check return value from memblock_phys_alloc_range()
At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of
contiguous free memory available at this point, the kernel will crash
and burn because memblock_phys_alloc_range() returns 0 on failure,
which leads memblock_phys_free() to throw the first 4 MiB of physical
memory to the wolves.
At a minimum it should fail gracefully with a meaningful diagnostic,
bu…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linuxa7259df7670240ee03b0cfce8a3e5d3773911e24 — 8c18c904d301ffeb33b071eadc55cd6131e1e9be+5
Also affects: Debian Linux 11.0