CVE-2025-38067: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38067 is a Linux kernel vulnerability in the Restartable Sequences (rseq) mechanism that can cause a segmentation fault on return to user-space when the rseq_cs field contains a non-zero, invalid pointer at registration time. The flaw was published on June 18, 2025, and affects Linux kernel versions from 4.18 through multiple stable branches up to 6.14.8, as well as Debian Linux 11.0. Fixed versions include 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, and 6.14.9. It carries a CVSS v3.1 base score of 5.5 (Medium) with a local attack vector (Feedly).

The root cause is improper input validation (CWE-20) in the kernel's rseq registration path: the kernel does not enforce the documented requirement that user-space set rseq_cs to zero before calling rseq(). If a thread registers with a non-zero rseq_cs pointing to an invalid struct rseq_cs, the kernel may dereference that pointer on return to user-space, triggering a segfault. A complicating factor is that older glibc versions reuse rseq areas from previous threads without clearing rseq_cs, and will terminate the process if rseq registration fails in a secondary thread — meaning simply rejecting non-zero registrations would break compatibility. The fix clears the rseq_cs field during registration when it is non-zero, preventing the segfault without breaking affected glibc versions (Feedly, Kernel Patch).

Successful exploitation of this vulnerability by a local, low-privileged user can cause a segmentation fault in the kernel's return-to-user-space path, resulting in process termination or a system crash (denial of service). The availability impact is rated High, while there is no confidentiality or integrity impact. The vulnerability does not enable privilege escalation or data exfiltration, but could be used to destabilize multi-threaded applications or services running on affected kernels (Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access and low privileges, limiting the practical attack surface (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to the following fixed versions or later: 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, or 6.14.9. Downstream distributions including Debian (DSA-5973-1, DSA-5975-1, DLA-4327-1), Ubuntu (USN-7770-1, USN-7771-1, USN-7774-1/3/4/5, USN-7775-1/2/3, USN-7789-1), Amazon Linux 2, and Oracle Linux 8 have issued their own kernel update advisories. No configuration-based workaround is available; patching is the only remediation (Feedly, Debian LTS, Ubuntu USN-7774-1).

The vulnerability received routine coverage from Linux distribution security teams, with Debian, Ubuntu, Amazon Linux, and Oracle Linux all issuing kernel update advisories. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability database and advisory tracking (Feedly).