CVE-2025-38689: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-38689 is a NULL pointer dereference vulnerability in the Linux kernel's x86 FPU (Floating Point Unit) handling, specifically in the avx512_status() function. When CONFIG_X86_DEBUG_FPU is enabled, reading /proc/[kthread]/arch_status triggers a warning and a NULL pointer dereference because the AVX-512 timestamp code calls x86_task_fpu() without checking for a NULL return value. The vulnerability affects Linux kernel versions 6.16 through 6.16.1 and 6.17-rc1. It was disclosed on September 4, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in avx512_status() within the x86 FPU subsystem. When CONFIG_X86_DEBUG_FPU is enabled, the x86_task_fpu() function is modified to return NULL for kernel threads (those with the PF_KTHREAD flag set), as a safeguard to prevent improper FPU state access outside of kernel_fpu_begin()/kernel_fpu_end() boundaries. The AVX-512 timestamp code, however, does not check for this NULL return before dereferencing the pointer, causing a kernel panic when any process reads /proc/[kthread]/arch_status. The fix stops emitting the AVX-512_elapsed_ms field for kernel threads entirely, since avx512_timestamp is only updated for user threads and the data was meaningless for kernel threads anyway (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic or system crash — a denial of service condition. The impact is limited to availability (CVSS availability impact: High), with no confidentiality or integrity impact. The vulnerability is only triggerable on x86 systems with CONFIG_X86_DEBUG_FPU enabled, which is a non-default debug configuration, limiting the scope of affected production systems (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term. The vulnerability requires local access with low privileges to trigger by reading a /proc entry, but is further constrained to systems compiled with the non-default CONFIG_X86_DEBUG_FPU kernel option. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory, Red Hat Bugzilla).

1. Identify a vulnerable target: Locate an x86 Linux system running kernel version 6.16 to 6.16.1 or 6.17-rc1, compiled with CONFIG_X86_DEBUG_FPU=y (a debug/development build option).
2. Obtain local access: Gain a local shell session with at least low-privilege user access on the target system.
3. Enumerate kernel threads in /proc: List kernel thread entries exposed via /proc, e.g., by running ls /proc/ and identifying kthread PIDs (typically low-numbered processes like kworker, ksoftirqd, etc.).
4. Trigger the NULL dereference: Read the arch_status file for a kernel thread, e.g., cat /proc/<kthread_pid>/arch_status. This causes avx512_status() to call x86_task_fpu(), which returns NULL for kernel threads under CONFIG_X86_DEBUG_FPU, triggering a NULL pointer dereference and kernel panic (Red Hat Bugzilla).

• Logs: Kernel log entries (via dmesg or /var/log/kern.log) showing a NULL pointer dereference or BUG/oops trace originating from avx512_status() or related x86 FPU code paths.
• Logs: Kernel warning messages referencing x86_task_fpu() returning NULL for a PF_KTHREAD process.
• Process/System: Unexpected system reboots or kernel panics on x86 systems with CONFIG_X86_DEBUG_FPU enabled, particularly following reads of /proc/[pid]/arch_status for kernel thread PIDs.

The primary fix is to update to Linux kernel version 6.16.2 or later, or 6.17-rc2 or later, which include the patches that stop emitting AVX-512_elapsed_ms for kernel threads (Kernel Patch 1, Kernel Patch 2). As a workaround for systems that cannot be immediately patched, disabling CONFIG_X86_DEBUG_FPU (which is not enabled in standard production kernels) eliminates the vulnerable code path. Additionally, restricting local user access to the affected system reduces the attack surface (Red Hat Advisory).