CVE-2025-38132: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38132 is a race condition vulnerability in the Linux kernel's CoreSight configuration management subsystem. It affects Linux kernel versions from 5.17 up to (but not including) 6.15.3, and was published on July 3, 2025 (Red Hat Advisory, Red Hat Bugzilla). The flaw occurs when iterating config_csdev_list during perf enable on one CPU while another CPU concurrently removes entries via cscfg_remove_owned_csdev_configs(), leading to a use-after-free or list corruption condition. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory).

The root cause is a concurrent access (race condition) bug classified as CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). Specifically, cscfg_csdev_enable_active_config() holds csdev->cscfg_csdev_lock while iterating config_csdev_list, but cscfg_remove_owned_csdev_configs() — called from a different CPU during config unload — modifies the same list without acquiring that lock, creating a window for list corruption (Red Hat Bugzilla). The fix extends the lock scope to cover cscfg_remove_owned_csdev_configs(), ensuring mutual exclusion during list traversal and deletion. Exploitation requires local access and the ability to trigger concurrent perf enable and module unload operations (Red Hat Advisory).

Successful exploitation of this race condition can cause a denial of service (DoS) through system instability, kernel crashes, or unexpected behavior resulting from corrupted list state in the CoreSight configuration subsystem. The vulnerability has no impact on confidentiality or integrity — only availability is affected (CVSS A:H). The scope is limited to the local system, with no lateral movement potential (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The vulnerability requires low-privileged local access and specific timing conditions (concurrent perf enable and config unload), making opportunistic exploitation difficult. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The fix is included in Linux kernel version 6.15.3 and the 6.16-rc1 development branch, via upstream commits 42f8afb0b161631fd1d814d017f75f955475ad41 and 53b9e2659719b04f5ba7593f2af0f2335f75e94a (Red Hat Bugzilla). Downstream distributions including SUSE and Ubuntu have issued patched kernel packages (SUSE advisories SUSE-2025-02969-1, SUSE-2025-02996-1, SUSE-2025-03011-1; Ubuntu USN-7769-1, USN-7770-1, USN-7771-1, USN-7789-1). As a workaround where patching is not immediately possible, restricting local user access to CoreSight sysfs interfaces and limiting the ability to load/unload CoreSight-related kernel modules can reduce exposure.