CVE-2025-38071: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38071 is a vulnerability discovered in the Linux kernel's memory management subsystem, specifically affecting the x86/mm component. The vulnerability was identified and disclosed on April 16, 2025, affecting systems configured with CONFIGPHYSICALSTART=0x100000 (CVE MITRE, NVD).

The vulnerability occurs due to improper handling of return values from the memblockphysallocrange() function. When there is less than 4 MiB of contiguous free memory available, the function returns 0 on failure, which subsequently causes memblockphys_free() to incorrectly deallocate the first 4 MiB of physical memory (Debian Tracker).

When the vulnerability is triggered, it can cause the kernel to crash and become unresponsive, potentially leading to system instability and denial of service conditions. This particularly affects systems where there is insufficient contiguous memory available at boot time (Wiz).

The vulnerability has been fixed in Linux kernel version 6.12.32-1. Systems running affected versions should upgrade to this or later versions. Debian has marked this version as fixed in their sid and trixie distributions (Debian Tracker).