CVE-2025-38033: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38033 is a vulnerability in the Linux kernel that affects the interaction between Rust code and FineIBT (Fine-grained Indirect Branch Tracking) functionality. The vulnerability was disclosed on June 18, 2025, impacting Linux kernel systems with Rust support enabled alongside FineIBT (NVD, Wiz).

The vulnerability manifests when calling core::fmt::write() from Rust code while FineIBT is enabled. The issue occurs because core::fmt::write() calls core::fmt::rt::Argument::fmt(), which has CFI (Control Flow Integrity) disabled. This leads to a Control Protection exception as FineIBT seals off the original function's endbr64 instruction, resulting in a kernel panic (NVD).

When exploited, the vulnerability causes a kernel panic, leading to system instability and potential denial of service conditions. The issue creates incompatibility between Rust code and FineIBT, affecting overall system stability and security on impacted Linux systems (Wiz).

A Kconfig dependency has been implemented that prevents FineIBT from being enabled by default if Rust is enabled. The permanent fix is expected in Rust 1.88.0, scheduled for release on June 26, 2025. Until then, systems can either disable FineIBT or wait for the Rust 1.88.0 update (NVD, Debian).