Security readout for executives and security teams
Plain-English summary
A Linux ARM Network Interconnect performance-monitoring driver can leave monitoring components registered when device setup fails. A later probe can corrupt a kernel list and cause a system panic, taking the host offline. The supplied record rates this local vulnerability 7.8 High.
Executive priority
Prioritize remediation for compatible ARM infrastructure where an unexpected kernel panic could disrupt critical services. Other Linux hosts are unlikely to share this specific driver path. Because exploitation is not established and triggering conditions are hardware-specific, use targeted inventory and patch verification rather than treating every Linux system as equally exposed.
Technical view
In arm-ni, a resource-allocation failure in one clock domain did not unregister PMUs already registered for other domains. Subsequent registration can encounter corrupted list state and trigger a fatal kernel exception. The supplied evidence demonstrates a kernel panic; it does not establish practical confidentiality or integrity compromise.
Likely exposure
Exposure appears limited to Linux systems using the ARM NI perf driver on compatible hardware where device probing encounters a resource-allocation failure. The supplied affected-version metadata includes Linux 6.12, 6.12.34, 6.15.3, and 6.16, but its exact range semantics are unclear. Vendor kernel backports require separate verification.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. However, the bundle provides no public exploitation evidence, and the CVE is not listed as KEV. The documented trigger is a driver probe failure leading to kernel list corruption and panic.
Researcher notes
The failure is an incomplete probe-error rollback: PMUs registered before a later clock-domain allocation failure remain registered. The trace shows re-registration reaching list validation and panicking. The bundle does not identify a CWE, working exploit, distribution package mapping, or unambiguous affected range; researchers should avoid extrapolating beyond compatible ARM NI configurations.
Mitigation direction
- Install a vendor-supported kernel containing the applicable ARM NI rollback fix.
- Compare vendor kernel backports against the three referenced stable Linux commits.
- Prioritize compatible ARM systems where the arm-ni driver is present or loaded.
- Check Linux distribution or hardware-vendor guidance before selecting a fixed package.
Validation and detection
- Inventory ARM systems and identify whether the arm-ni driver is available or loaded.
- Record kernel versions, distribution build identifiers, and vendor backport status.
- Review kernel logs for arm-ni probe failures, PMU registration errors, or list corruption.
- Confirm the installed source or package includes an applicable referenced stable commit.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38168 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7e958e116e3be05a1f869b5a885fc5d674c7725fCVE reference, Linux
- https://git.kernel.org/stable/c/72caf9886e9c1731cf7bfe3eabc308b9268b21d6CVE reference, Linux
- https://git.kernel.org/stable/c/7f57afde6a44d9e044885e1125034edd4fda02e8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.