CVE-2025-38334: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38334 is a vulnerability in the Linux kernel's x86/SGX (Software Guard Extensions) subsystem where the SGX page reclaimer fails to check whether an EPC (Enclave Page Cache) page has been marked as poisoned before attempting to reclaim it. This flaw affects Linux kernel versions 5.11 through 6.15.3, specifically: 5.11–6.1.141, 6.2–6.6.94, 6.7–6.12.34, and 6.13–6.15.3. It was published on July 10, 2025, and patches were added to stable branches on December 16, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium), with local access required and high availability impact (Feedly).

The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions). When a hardware memory error (machine check exception/MCE) poisons an EPC page used by an SGX enclave, arch_memory_failure() sets epc_page->poison, but the page remains on sgx_active_page_list with the SGX_EPC_PAGE_RECLAIMER_TRACKED flag unchanged. The SGX reclaimer does not check epc_page->poison before attempting to reclaim the page, causing it to invoke the EWB microcode operation, which accesses the poisoned page's contents to encrypt and write them to non-SGX memory. Because SGX microcode operations cannot gracefully handle MCEs during their execution, the affected CPU core enters a special shutdown state (impacting both hyperthreads), and the kernel subsequently panics when remaining cores detect the missing MCE handler acknowledgment. The fix calls sgx_unmark_page_reclaimable() on poisoned pages to remove them from the reclaim list (Feedly, Kernel Patch).

Successful triggering of this vulnerability results in a kernel panic and system crash, causing a complete loss of availability for the affected host. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition. Systems running SGX-enabled workloads (e.g., confidential computing environments, SGX enclave hosts) are at greatest risk, as the crash requires the presence of a hardware memory error on an active EPC page (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-38334. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability requires local access with low privileges, but also depends on a hardware memory error (poisoned EPC page) occurring — a condition that is difficult to reliably trigger in practice. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Qualys and Nessus scanner plugins (Feedly).

Apply the upstream Linux kernel patches that introduce a check for epc_page->poison in the SGX reclaimer path before attempting page reclaim. Fixed versions include: 6.1.142+, 6.6.95+, 6.12.35+, and 6.15.4+. Ubuntu has issued security notices USN-7834-1 and USN-7856-1 addressing this vulnerability. Debian Linux 11.0 is also listed as an affected product. Organizations should prioritize patching systems running SGX workloads or confidential computing environments. No configuration-based workaround is known; upgrading to a patched kernel version is the recommended remediation (Feedly, Ubuntu USN-7834-1, Ubuntu USN-7856-1).