LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38049: x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors

In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors Commit 6eac36bb9eb0 ("x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid") added logic that causes resctrl to search for the CLOSID with the fewest dirty cache lines when creating a new control group, if requested by the arch code. This depends on the values read from the llc_occupancy counters. The logic is applicable to architectures where the CLOSID effectively forms part of the monitoring identifier and so do not allow complete freedom to choose an unused monitoring identifier for a given CLOSID. This support missed that some platforms may not have these counters. This causes a NULL pointer dereference when creating a new control group as the array was not allocated by dom_data_init(). As this feature isn't necessary on platforms that don't have cache occupancy monitors, add this to the check that occurs when a new control group is allocated.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-38049 is a Linux kernel crash bug in x86 resctrl. A local user with relevant access can trigger a NULL pointer dereference when creating a new resctrl control group on platforms without cache occupancy monitors. The business impact is availability loss, not data theft or privilege escalation based on the supplied sources.

Executive priority

Treat as a moderate availability risk. It is not a remote compromise based on current evidence, but it can crash affected Linux systems from a local path. Patch during the next appropriate kernel maintenance window, sooner for shared or high-availability infrastructure.

Technical view

The bug is in x86/resctrl CLOSID selection logic added by commit 6eac36bb9eb0. It searches closid_num_dirty_rmid using LLC occupancy data, but some platforms lack those counters, leaving the array unallocated. Creating a new control group can dereference NULL. CVSS is 5.5, local, low complexity, low privileges, availability high.

Likely exposure

Exposure is likely limited to Linux systems running affected kernel ranges and using x86 resctrl on platforms without cache occupancy monitors. Internet-facing exposure is not indicated. Multi-user systems, virtualization hosts, and shared compute environments deserve priority because local users may reach the affected path.

Exploitation context

The provided sources do not show active exploitation, and KEV is false. The vulnerability requires local access with low privileges and no user interaction. The known impact is denial of service through a kernel crash path, not confidentiality or integrity compromise.

Researcher notes

Focus review on x86 resctrl control group creation, CLOSID allocation, LLC occupancy monitor availability, and whether dom_data_init allocated the expected array. Evidence is limited to the CVE record and Linux stable commit references; no public exploit or downstream vendor advisory is included in the bundle.

Mitigation direction

  • Update to a kernel build containing the referenced stable resctrl fixes.
  • Use distribution kernel updates or vendor backports when available.
  • Prioritize shared Linux hosts where untrusted local users exist.
  • Restrict resctrl control group management to trusted administrators.
  • If patching is delayed, check vendor guidance for supported temporary mitigations.

Validation and detection

  • Inventory Linux hosts and record exact kernel versions.
  • Identify systems using x86 resctrl or exposing resctrl management.
  • Check whether kernels include the referenced stable commits or vendor backports.
  • Review kernel crash logs for NULL pointer dereferences in x86/resctrl.
  • Validate fixes in staging before broad production rollout.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-476: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-38049 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2025-38049Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6eac36bb9eb0349c983313c71692c19d50b56878, 6eac36bb9eb0349c983313c71692c19d50b56878, 6eac36bb9eb0349c983313c71692c19d50b56878, 6eac36bb9eb0349c983313c71692c19d50b56878unaffected
LinuxLinux6.9, 0, 6.12.23, 6.13.11, 6.14.2, 6.15affected
Weakness

CWE details

CWE-476

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-476 · source CWE mapping

NULL Pointer Dereference

NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs