CVE-2025-38298: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38298 is an out-of-bounds write vulnerability in the Linux kernel's EDAC/skx_common module, specifically within the skx_edac_common component used by Intel server memory error detection and correction (EDAC) drivers. The flaw occurs when the i10nm_edac module is unloaded and reloaded without properly resetting the adxl_component_count variable, causing a double-count of ADXL components and an out-of-bounds reference to the ADXL component array. This results in a general protection fault (kernel crash). Affected Linux kernel versions span multiple stable series: 5.4.282–5.4.295, 5.10.224–5.10.239, 5.15.165–5.15.186, 6.1.103–6.1.142, 6.6.44–6.6.94, 6.10.3–6.12.34, and 6.13–6.15.3. It was published on July 10, 2025, with a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is classified as CWE-787 (Out-of-bounds Write). The variable adxl_component_count in skx_edac_common is incremented during module initialization to track the number of ADXL (Address Decode eXtension Layer) components, but is never reset in the adxl_put() cleanup function called during module unload. When i10nm_edac is unloaded and reloaded, the count is incremented again on top of the stale value, resulting in a count double the actual number of components. Subsequent access to the ADXL component array using this inflated index causes an out-of-bounds memory reference, triggering a general protection fault via the call chain: skx_mce_check_error → skx_adxl_decode → snprintf → vsnprintf → string. The fix resets adxl_component_count to zero inside adxl_put() (Feedly, Kernel Patch).

Successful exploitation can cause a kernel general protection fault, leading to system crash and denial of service. An attacker with local, low-privileged access who can load and unload kernel modules (or trigger the condition through error injection) could corrupt kernel memory, potentially affecting system stability and availability. The vulnerability's out-of-bounds write nature also carries a theoretical risk of kernel memory corruption that could impact confidentiality and integrity, though the primary observed impact is system crash (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires local access with low privileges and the ability to unload and reload the i10nm_edac kernel module, which limits the attack surface to privileged local users or those with module management capabilities. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing mce: [Hardware Error]: Machine check events logged followed by Oops: general protection fault with a call trace involving skx_adxl_decode, skx_mce_check_error, snprintf, and vsnprintf.
• Process/Kernel: Workqueue entries for mce_gen_pool_process appearing in kernel traces around the time of i10nm_edac module reload.
• Module Activity: System logs showing repeated modprobe/rmmod operations on i10nm_edac or skx_edac_common modules in close succession, particularly on Intel Xeon Scalable (Skylake/Ice Lake) server platforms.

Apply the upstream kernel patches that reset adxl_component_count in adxl_put(). Fixed versions are available across multiple stable series: 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34, and 6.15.3 (Feedly, Kernel Patch). Distribution-specific patches have been released by Ubuntu (USN-7769-1, USN-7774-1, USN-7789-1, and others), Amazon Linux 2 (ALAS2KERNEL-5.15-2025-082, ALAS2KERNEL-5.4-2025-104, ALAS2KERNEL-5.10-2025-098), and Debian. As a workaround, avoid repeatedly unloading and reloading the i10nm_edac module on affected systems, and restrict kernel module management to trusted administrators.

The vulnerability has been addressed through standard Linux kernel stable tree processes, with patches backported across multiple long-term support branches. Ubuntu, Amazon Linux, Debian, Oracle Linux, and SUSE have all issued distribution-specific advisories and updated kernel packages. No notable independent researcher commentary or significant social media discussion has been observed beyond routine vulnerability tracking (Ubuntu USN-7769-1, Amazon Linux Advisory).