CVE-2025-38255: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38255 is a vulnerability discovered in the Linux kernel affecting the lib/group_cpus component, specifically in the group_cpus_evenly() function. The vulnerability was disclosed on July 9, 2025, and involves a NULL pointer dereference issue that can lead to system crashes (NVD, Debian).

The vulnerability occurs when numgrps is set to 0, causing ZERO_SIZE_PTR to be returned from kcalloc(), which is later dereferenced. This can be triggered while testing null_blk with configfs by executing 'echo 0 > poll_queues'. The issue has been assigned a CVSS v3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating moderate severity with local access required (Red Hat).

When exploited, this vulnerability results in a kernel panic due to NULL pointer dereference, causing system crashes and potential denial of service. The impact is primarily focused on system availability, with no direct effect on confidentiality or integrity (Red Hat).

The issue has been fixed by implementing a check for numgrps in group_cpus_evenly() function, which returns NULL directly if numgrps is zero. This fix has been implemented in various Linux distributions, including fixes for both SMP and non-SMP versions (Debian).