Security readout for executives and security teams
Plain-English summary
This CVE covers a Linux kernel Landlock issue found by KUnit testing. A randomized test could pass zero where a positive value was expected, causing a kernel warning. Sources do not describe data loss, privilege escalation, remote access, or active exploitation.
Executive priority
Treat this as low urgency unless affected kernels are broadly deployed in sensitive environments. Fold remediation into normal kernel maintenance and vendor patch cycles, while monitoring for any later severity clarification.
Technical view
In Landlock ID range handling, get_id_range() expects a positive first argument, while get_random_u8() can return 0. The referenced fix clamps the randomized value and was validated by repeating the KUnit test 1000 times. No CVSS, CWE, or runtime exploit details are provided.
Likely exposure
Exposure appears limited to Linux kernels in the CVE affected range, including listed 6.15 and related stable versions. Business exposure depends on whether affected kernels are deployed and whether Landlock code paths are relevant.
Exploitation context
The bundle shows no KEV listing and no cited evidence of active exploitation. The available description centers on a KUnit warning during randomized kernel tests, not a documented real-world attack path.
Researcher notes
Evidence is incomplete for impact: the CVE has no CVSS vector, CWE, or exploit narrative. The strongest source detail indicates a test-triggered warning caused by zero input to a positive-range helper, fixed by clamping.
Mitigation direction
- Inventory Linux kernel versions against the CVE affected list.
- Review vendor kernel advisories for fixed package versions.
- Prioritize routine kernel updates where affected versions are present.
- Track the referenced stable kernel commits in downstream distributions.
Validation and detection
- Confirm deployed kernel versions on Linux assets.
- Check whether vendor packages include the referenced stable fixes.
- Review kernel logs for related Landlock warnings if testing affected kernels.
- Run relevant kernel or vendor regression tests after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38651 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/127183361b69dbb7ac3246ad4726f93400481249CVE reference, Linux
- https://git.kernel.org/stable/c/7d9ec2cfe12dd0d7c1a58213b9bef1bec66a3189CVE reference, Linux
- https://git.kernel.org/stable/c/e0a69cf2c03e61bd8069becb97f66c173d0d1fa1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.