#VU112256 Resource management error in Linux kernel - CVE-2025-38170

Vulnerability identifier: #VU112256

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38170

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the do_sme_acc() function in arch/arm64/kernel/fpsimd.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/43be952e885476dafb74aa832c0847b2f4f650c6
https://git.kernel.org/stable/c/6103f9ba51a59afb5a0f32299c837377c5a5a693
https://git.kernel.org/stable/c/c4a4786d93e99517d6f10ed56b9ffba4ce88d3b3
https://git.kernel.org/stable/c/d3eaab3c70905c5467e5c4ea403053d67505adeb
https://git.kernel.org/stable/c/de89368de3894a8db27caeb8fd902ba1c49f696a

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.