Out-of-bounds read in Linux kernel platforms powernv

1) Out-of-bounds read

EUVDB-ID: #VU112116

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38088

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the memtrace_read() function in arch/powerpc/platforms/powernv/memtrace.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/620b77b23c41a6546e5548ffe2ea3ad71880dde4
https://git.kernel.org/stable/c/81260c41b518b6f32c701425f1427562fa92f293
https://git.kernel.org/stable/c/8635e325b85dfb9ddebdfaa6b5605d40d16cd147
https://git.kernel.org/stable/c/9c340b56d60545e4a159e41523dd8b23f81d3261
https://git.kernel.org/stable/c/bbd5a9ddb0f9750783a48a871c9e12c0b68c5f39
https://git.kernel.org/stable/c/cd097df4596f3a1e9d75eb8520162de1eb8485b2

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.