CVE-2025-38071

MediumCVSS 5.5/10Last modified Nov 5, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Check return value from memblock_phys_alloc_range()

At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblock_phys_alloc_range() returns 0 on failure, which leads memblock_phys_free() to throw the first 4 MiB of physical memory to the wolves.

At a minimum it should fail gracefully with a meaningful diagnostic, but in fact everything seems to work fine without the weird reserve allocation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= a7259df7670240ee03b0cfce8a3e5d3773911e24, < 8c18c904d301ffeb33b071eadc55cd6131e1e9be; >= a7259df7670240ee03b0cfce8a3e5d3773911e24, < bffd5f2815c5234d609725cd0dc2f4bc5de2fc67; >= a7259df7670240ee03b0cfce8a3e5d3773911e24, < c6f2694c580c27dca0cf7546ee9b4bfa6b940e38; >= a7259df7670240ee03b0cfce8a3e5d3773911e24, < dde4800d2b0f68b945fd81d4fc2d4a10ae25f743; >= a7259df7670240ee03b0cfce8a3e5d3773911e24, < 631ca8909fd5c62b9fda9edda93924311a78a9c4
LinuxLinux5.15
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *

References

Timeline

Published
Jun 18, 2025
Last modified
Nov 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-380725.5In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Fix divide error in nd_label_data_init() If a faultyCVE-2025-380745.5In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_used with vq->mutex The vhost-scsi completCVE-2025-380755.5In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response CVE-2025-380767.8In the Linux kernel, the following vulnerability has been resolved: alloc_tag: allocate percpu counters for module tags dynamically When aCVE-2025-380777.8In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_passworCVE-2025-380784.7In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race of buffer access at PCM OSS layer The PCM OSS layeCVE-2025-380797.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is caCVE-2025-38086.5A vulnerability has been found in zhenfeng13 My-BBS 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulaCVE-2025-380805.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase block_sequence array size [Why] It's possiblCVE-2025-380817.1In the Linux kernel, the following vulnerability has been resolved: spi-rockchip: Fix register out of bounds access Do not write native chCVE-2025-380827.8In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix potential out-of-bound write If the caller wrote mCVE-2025-380834.7In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race
CVE-2025-38071: Medium severity, CVSS 5.5 | Vulnix