Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s LZO compression handling can write beyond an output buffer because compression ignored the caller’s buffer length. A successful local attack could potentially compromise confidentiality, integrity, and availability. Actual exposure depends on whether the affected kernel code is present and reachable.
Executive priority
Treat as a high-priority kernel update, especially on systems running untrusted local workloads. It is not supported as an internet-scale emergency because the documented attack vector is local and active exploitation is unconfirmed. Require owners to establish exposure and patch status promptly.
Technical view
The crypto/lzo compression path assumed sufficient output space and did not check for overruns before writes. The kernel fix introduces a safe compression interface that verifies the buffer boundary. CVSS 3.1 rates it 7.8: local access, low complexity, low privileges, no user interaction, and potentially high impact across confidentiality, integrity, and availability.
Likely exposure
Linux systems running affected kernel branches may be exposed when the crypto/lzo compression path is available and reachable. The supplied version data is not sufficiently clear for reliable boundary matching, especially with vendor backports. Confirm exposure using distribution advisories, kernel package provenance, configuration, and fix-commit presence.
Exploitation context
The supplied CVSS vector describes a local, low-privileged attack rather than direct remote exploitation. CISA KEV status is false, and the supplied sources do not establish active exploitation or a public exploit. Practical exploitability and reachable callers are not documented in the bundle.
Researcher notes
The core defect is an unchecked output-boundary assumption in crypto/lzo compression. Review should focus on reachable callers, attacker influence over input and output sizing, and vendor backport equivalence. The bundle provides multiple stable-tree commits but does not clearly map every commit to a kernel branch or corrected release boundary.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream stable fix or backport.
- Consult the Linux distribution’s advisory for exact affected and corrected package versions.
- Prioritize multi-user, shared-hosting, container-host, and other systems permitting untrusted local workloads.
- Use vendor-approved exposure reduction if patching is delayed; no specific workaround is documented here.
Validation and detection
- Inventory deployed kernel packages and map them against vendor advisories, including backported fixes.
- Verify whether the running kernel includes the applicable referenced stable commit or equivalent backport.
- Determine whether crypto/lzo support is configured, available, and reachable by untrusted local users.
- After updating, confirm the corrected kernel is running across hosts and immutable images.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38068 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4b173bb2c4665c23f8fcf5241c7b06dfa6b5b111CVE reference, Linux
- https://git.kernel.org/stable/c/a98bd864e16f91c70b2469adf013d713d04d1d13CVE reference, Linux
- https://git.kernel.org/stable/c/0acdc4d6e679ba31d01e3e7e2e4124b76d6d8e2aCVE reference, Linux
- https://git.kernel.org/stable/c/7caad075acb634a74911830d6386c50ea12566cdCVE reference, Linux
- https://git.kernel.org/stable/c/167373d77c70c2b558aae3e327b115249bb2652cCVE reference, Linux
- https://git.kernel.org/stable/c/cc47f07234f72cbd8e2c973cdbf2a6730660a463CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.