In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow. In this case the actual size of the allocated area and the value describing it won't be in sync leading to various types of unpredictable behaviour later. Use a proper memdup_array_user() helper which returns an error if an overflow is detected. Note that it is different from when nr_apqns is initially zero - that case is considered valid and should be handled in subsequent pkey_handler implementations. Found by Linux Verification Center (linuxtesting.org).

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/73483ca7e07a5e39bdf612eec9d3d293e8bef649 cve-icon cve-icon
https://git.kernel.org/stable/c/7360ee47599af91a1d5f4e74d635d9408a54e489 cve-icon cve-icon
https://git.kernel.org/stable/c/88f3869649edbc4a13f6c2877091f81cd5a50f05 cve-icon cve-icon
https://git.kernel.org/stable/c/ad1bdd24a02d5a8d119af8e4cd50933780a6d29f cve-icon cve-icon
https://git.kernel.org/stable/c/f855b119e62b004a5044ed565f2a2b368c4d3f16 cve-icon cve-icon
https://git.kernel.org/stable/c/faa1ab4a23c42e34dc000ef4977b751d94d5148c cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025070935-CVE-2025-38257-3e5d@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-38257 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-38257 cve-icon
History

Tue, 15 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00024}

 epss

{'score': 0.00032}

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00018}

 epss

{'score': 0.00024}

Thu, 10 Jul 2025 14:30:00 +0000

Type Values Removed Values Added
References

Thu, 10 Jul 2025 00:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 09 Jul 2025 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow. In this case the actual size of the allocated area and the value describing it won't be in sync leading to various types of unpredictable behaviour later. Use a proper memdup_array_user() helper which returns an error if an overflow is detected. Note that it is different from when nr_apqns is initially zero - that case is considered valid and should be handled in subsequent pkey_handler implementations. Found by Linux Verification Center (linuxtesting.org).
Title s390/pkey: Prevent overflow in size calculation for memdup_user()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-07-09T10:42:34.395Z

Updated: 2025-07-28T04:16:22.240Z

Reserved: 2025-04-16T04:51:23.997Z

Link: CVE-2025-38257

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-07-09T11:15:27.993

Modified: 2025-07-10T15:15:27.730

Link: CVE-2025-38257

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-07-09T00:00:00Z

Links: CVE-2025-38257 - Bugzilla