CVE-2025-38383: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38383 is a data race vulnerability in the Linux kernel's mm/vmalloc subsystem, specifically within the show_numa_info() function. The flaw was discovered via KCSAN (Kernel Concurrency Sanitizer) and publicly disclosed on July 25, 2025. It affects Linux kernel versions 6.9 through 6.12.36 (fixed in 6.12.37) and 6.13 through 6.15.5 (fixed in 6.15.6) (Feedly). The vulnerability carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly).

The root cause is a concurrent read/write data race (CWE-362) in show_numa_info() within mm/vmalloc.c. The issue arises because m->private — a heap-allocated buffer initialized in proc_vmalloc_init() — is shared across multiple CPUs without proper synchronization. When multiple tasks concurrently read /proc/vmallocinfo, two tasks can simultaneously read and write to the same memory address (e.g., 0xffff88800971fe30), as detected by KCSAN. The fix moves heap allocation into vmalloc_info_show() itself so each invocation uses its own local buffer, eliminating the shared-state race (Feedly, Kernel Patch).

Successful exploitation of this race condition can result in a denial of service (system crash or kernel instability) due to corrupted memory state during concurrent reads of /proc/vmallocinfo. There is no impact on confidentiality or integrity — the availability impact is the sole concern. The vulnerability requires local access with low privileges, limiting its scope to users who can read procfs entries on the affected system (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-38383. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to trigger concurrent reads of /proc/vmallocinfo, making opportunistic exploitation unlikely (Feedly).

The Linux kernel project has released patches addressing this vulnerability in stable branches. Users should upgrade to kernel version 6.12.37 or later (for the 6.9–6.12 branch) or 6.15.6 or later (for the 6.13–6.15 branch). Downstream distributions including Ubuntu (USN-7834-1) and Red Hat (RHSA-2026:1178, RHSA-2026:2761) have issued updated kernel packages. No configuration-based workaround is available; patching is the only remediation (Feedly, Ubuntu Advisory, Red Hat Advisory).