Security readout for executives and security teams
Plain-English summary
A local, low-privileged user on an affected Linux s390 system may trigger an integer overflow in the protected-key subsystem. The resulting allocation mismatch can cause unpredictable kernel behavior, with potential service disruption, data exposure, or limited data modification. The issue is not described as remotely exploitable.
Executive priority
Treat this as high priority for multi-user or sensitive s390 environments because a low-privileged local actor could affect confidentiality and availability. Rapidly identify exposed s390 systems and schedule supported kernel updates. Organizations without s390 workloads should document non-exposure after verification rather than initiate broad emergency patching.
Technical view
The s390 pkey ioctl accepts a user-controlled APQN entry count. Multiplication used to size memdup_user() can overflow, leaving the allocation smaller than the recorded list size and creating unsafe behavior in later processing. The stable fix replaces this operation with memdup_array_user(), which detects overflow and returns an error.
Likely exposure
Exposure is concentrated on Linux systems using the s390 architecture and affected pkey code, particularly where low-privileged local users can invoke the relevant ioctl. Non-s390 systems are not implicated by the supplied description. The bundle's version data is ambiguous, so administrators should confirm distribution-specific backport status rather than rely solely on version numbers.
Exploitation context
The CVSS vector indicates local access, low privileges, low complexity, and no user interaction. The supplied bundle reports that this CVE is not in KEV and provides no evidence of active exploitation or a public exploit. Practical exploitation conditions and reliability are not established by these sources.
Researcher notes
The critical invariant is synchronization between the allocated APQN array size and nr_apqns. Overflow breaks that invariant before later pkey handlers consume the list. The fix deliberately preserves zero entries as valid while rejecting arithmetic overflow. The sources do not establish the precise resulting memory-safety primitive, exploitability, or affected configuration requirements.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable stable fix for CVE-2025-38257.
- Prioritize s390 systems that expose or use the pkey ioctl interface.
- Follow distribution guidance for backported packages and required reboot procedures.
- Reduce untrusted local account access until affected systems are updated.
Validation and detection
- Confirm whether each system runs the s390 architecture and uses the pkey subsystem.
- Record the running kernel build and compare it with vendor backport guidance.
- Check whether the applicable stable fix is present in the deployed kernel source or package changelog.
- After maintenance, confirm the patched kernel is installed and currently running.
- Monitor vendor advisories for revised affected-version boundaries or exploitation information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38257 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ad1bdd24a02d5a8d119af8e4cd50933780a6d29fCVE reference, Linux
- https://git.kernel.org/stable/c/faa1ab4a23c42e34dc000ef4977b751d94d5148cCVE reference, Linux
- https://git.kernel.org/stable/c/88f3869649edbc4a13f6c2877091f81cd5a50f05CVE reference, Linux
- https://git.kernel.org/stable/c/f855b119e62b004a5044ed565f2a2b368c4d3f16CVE reference, Linux
- https://git.kernel.org/stable/c/73483ca7e07a5e39bdf612eec9d3d293e8bef649CVE reference, Linux
- https://git.kernel.org/stable/c/7360ee47599af91a1d5f4e74d635d9408a54e489CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.