Security readout for executives and security teams
Plain-English summary
A Linux kernel defect on 64-bit PowerPC systems can corrupt a processor register while livepatching, potentially causing kernel crashes or incorrect privileged memory operations. The supplied CVSS assessment rates possible confidentiality, integrity, and availability impact as high, but exploitation requires local low-privileged access and a relevant system configuration.
Executive priority
Treat as a high-priority infrastructure issue where powerpc64 systems use livepatching or host untrusted local users. Prioritize inventory and vendor-backed kernel updates. Broad emergency action across non-PowerPC fleets is not supported by the supplied evidence.
Technical view
On powerpc64 with PPC_FTRACE_OUT_OF_LINE, ftrace clobbers register r15. The livepatch sequence failed to restore r15, allowing subsequent kernel execution to use corrupted state and trigger invalid memory access. The cited kernel changes restore r15 consistently. The supplied affected range includes Linux 6.13 through 6.15.4 and 6.16, but distributor-specific backports require verification.
Likely exposure
Exposure is most relevant to powerpc64 Linux systems using out-of-line ftrace and live kernel patching. Internet reachability alone does not create exposure because the supplied vector is local. Systems on other architectures or without the implicated functionality are less likely to be affected, but kernel vendor status should determine final scope.
Exploitation context
The supplied CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. Successful abuse could affect kernel confidentiality, integrity, and availability. The source bundle reports no CISA KEV listing and provides no evidence of active exploitation or a public weaponized exploit.
Researcher notes
The demonstrated failure is a kernel bad-area write following r15 corruption, but the sources do not establish a reliable privilege-escalation technique. Assess reachability through the precise ftrace and livepatch build/runtime path. Version strings alone may misclassify distribution kernels because fixes can be backported independently.
Mitigation direction
- Identify powerpc64 systems using livepatching and out-of-line ftrace; prioritize those permitting untrusted local access.
- Install a vendor-supported kernel update containing the cited r15 restoration fix.
- If updates are unavailable, obtain configuration-specific mitigation guidance from the kernel or distribution vendor.
- Restrict unnecessary local accounts and workloads until affected systems are remediated.
Validation and detection
- Confirm each system's architecture, kernel release, livepatch usage, and relevant ftrace configuration.
- Verify the installed kernel includes a vendor backport or one of the cited stable fixes.
- Review kernel logs for bad-area access, register corruption, or crashes occurring during livepatch operations.
- After updating, validate livepatch operations in a controlled environment and monitor for renewed kernel faults.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38233 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a9212bf5ca640232254b31330e86272fe4073bc9CVE reference, Linux
- https://git.kernel.org/stable/c/cb5b691f8273432297611863ac142e17119279e0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.