Security readout for executives and security teams
Plain-English summary
A locally authenticated user could misuse Linux uprobes to disrupt or manipulate another execution path, potentially compromising confidentiality, integrity, and availability. The kernel fix restores a strong administrative privilege requirement, limiting uprobe creation to processes with CAP_SYS_ADMIN.
Executive priority
Treat as a high-priority local privilege-boundary issue. Accelerate patching on shared, multi-user, development, and other systems running untrusted local workloads. Remote-only servers with tightly controlled local access may be sequenced behind demonstrably exposed hosts.
Technical view
The kernel accepted uprobes at offsets containing valid instructions without proving the offset aligned with the intended variable-length instruction stream. On architectures such as arm64, text segments may also contain data mistaken for instructions. The resolution requires CAP_SYS_ADMIN for uprobes.
Likely exposure
Exposure applies to affected Linux kernels where a low-privileged local process can create uprobes without CAP_SYS_ADMIN. Internet reachability alone does not create exposure. The supplied version data is ambiguous, so confirm status using the running kernel build and vendor guidance.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. The bundle marks KEV false and provides no evidence of active exploitation.
Researcher notes
The core weakness is unsafe uprobe placement relative to the intended instruction stream, plus instruction-versus-data ambiguity on mixed text segments. The fix is authorization hardening rather than complete instruction-stream validation. No CWE is assigned, and the supplied evidence does not establish public exploitation.
Mitigation direction
- Install a vendor-supported kernel update containing the uprobe privilege fix.
- Prioritize multi-user systems where untrusted local users can access performance tracing facilities.
- Until updated, restrict untrusted local access and review vendor-recommended temporary mitigations.
Validation and detection
- Record each system's running kernel version, build, architecture, and distribution package release.
- Confirm through vendor advisories that the installed kernel includes the relevant stable fix.
- Verify unprivileged processes cannot create uprobes without CAP_SYS_ADMIN after remediation.
- Review monitoring data for unexpected uprobe or performance-tracing activity by non-administrative users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38466 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d7ef1afd5b3f43f4924326164cee5397b66abd9cCVE reference, Linux
- https://git.kernel.org/stable/c/c0aec35f861fa746ca45aa816161c74352e6ada8CVE reference, Linux
- https://git.kernel.org/stable/c/8e8bf7bc6aa6f583336c2fda280b6cea0aed5612CVE reference, Linux
- https://git.kernel.org/stable/c/183bdb89af1b5193b1d1d9316986053b15ca6fa4CVE reference, Linux
- https://git.kernel.org/stable/c/a0a8009083e569b5526c64f7d3f2a62baca95164CVE reference, Linux
- https://git.kernel.org/stable/c/d5074256b642cdeb46a70ce2f15193e766edca68CVE reference, Linux
- https://git.kernel.org/stable/c/ba677dbe77af5ffe6204e0f3f547f3ba059c6302CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.