CVE-2025-38366: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-38366 is an array pointer overflow vulnerability in the Linux kernel's LoongArch KVM implementation, caused by insufficient validation of the num_cpu parameter supplied from user space. The flaw resides in the EIOINTC (External Interrupt Controller) irqchip handling, where the maximum supported CPU number (EIOINTC_ROUTE_MAX_VCPUS) is not enforced before use. Affected kernel versions span 6.13 through 6.15.4 and release candidates 6.16-rc1 through 6.16-rc3. It was published on July 25, 2025, with a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-129 / out-of-bounds write) in the LoongArch KVM subsystem: when user space passes a num_cpu value exceeding EIOINTC_ROUTE_MAX_VCPUS, the kernel does not reject it, leading to an array pointer overflow. An attacker with local access and low privileges (e.g., a guest VM user or a local user with KVM access) can craft a malicious ioctl call supplying an oversized num_cpu value to trigger the overflow. The fix adds an explicit bounds check on the user-supplied CPU count before it is used to index into the EIOINTC routing array. Patches are available in the Linux stable tree at commits a3293b4078ee and cc8d5b209e09 (Red Hat Bugzilla, Kernel Stable).

Successful exploitation could allow a low-privileged local attacker to cause an array pointer overflow in kernel memory, potentially leading to unauthorized access to sensitive kernel data (high confidentiality impact), corruption of kernel memory structures (high integrity impact), or a system crash/denial of service (high availability impact). In a virtualized environment, a malicious guest or local user with KVM device access could potentially escalate privileges on the host system. The scope is limited to the local system, but the consequences on affected LoongArch-based systems running vulnerable kernel versions are severe (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface primarily to multi-tenant virtualization environments on LoongArch hardware.

The Linux kernel stable releases 6.15.5 and 6.16-rc4 include the fix for this vulnerability. Administrators should update to kernel version 6.15.5 or later, or apply the upstream patches (a3293b4078ee and cc8d5b209e09) from the Linux stable tree. As a compensating control, restrict local user access to KVM devices (e.g., limit /dev/kvm permissions) to reduce exposure on LoongArch systems. Red Hat has tracked this issue and kernel updates from trusted distribution channels should be applied promptly (Red Hat Bugzilla, Kernel Stable).