CVE-2025-38076: 
Linux Ubuntu vulnerability analysis and mitigation

A vulnerability (CVE-2025-38076) was discovered in the Linux kernel related to the allocation of percpu counters for module tags. The issue was disclosed on June 18, 2025, affecting the kernel's memory management system, specifically in the handling of module tag allocation (NVD, Wiz).

The vulnerability occurs in the module unloading process. When a module is unloaded, it checks if any of its tags are still in use and keeps the memory containing module's allocation tags alive if needed. However, the percpu counters referenced by the tags are freed by free_module(). This leads to a Use-After-Free (UAF) condition if the memory allocated by a module is accessed after the module has been unloaded (NVD, Wiz).

When exploited, this vulnerability can lead to Use-After-Free conditions in the Linux kernel, potentially resulting in memory corruption and system instability. The issue specifically impacts scenarios where module memory is accessed after the module has been unloaded (Wiz).

The fix involves modifying the allocation mechanism to allocate percpu counters for module allocation tags dynamically and maintaining them for tags that are still in use after module unloading. This solution also removes the requirement of a larger PERCPUMODULERESERVE when memory allocation profiling is enabled (NVD, Wiz).