Linux: Exposure of Resource to Wrong Sphere
CVE-2025-38670 is a high-severity exposure of resource to wrong sphere vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions f7e0231eeaa33245c649fac0303cf97209605446, 407047893a64399f2d2390ff35cc6061107d805d, a6b0cb523eaa01efe8a3f76ced493ba60674c6e6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to f7e0231eeaa33245c649fac0303cf97209605446 or 407047893a64399f2d2390ff35cc6061107d805d or a6b0cb523eaa01efe8a3f76ced493ba60674c6e6 or 9433a5f437b0948d6a2d8a02ad7a42ab7ca27a61, whichever matches your release line, or a later version.
- Update SIMATIC CN 4100 to V5.0 or a later version.
- Update Linux Kernel to 5.10.210 or 5.15.190 or 6.1.149 or 6.6.101, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 3f225f29c69c13ce1cbdb1d607a42efeef080056 up to, but not including, f7e0231eeaa33245c649fac0303cf97209605446; 402d2b1d54b7085d0c3bfd01fd50c2701dde64b3 up to, but not including, 407047893a64399f2d2390ff35cc6061107d805d; 4403c7b7e5e1ad09a266b6e399fd7bf97931508e up to, but not including, a6b0cb523eaa01efe8a3f76ced493ba60674c6e6; 59b37fe52f49955791a460752c37145f1afdcad1 up to, but not including, 9433a5f437b0948d6a2d8a02ad7a42ab7ca27a61; 59b37fe52f49955791a460752c37145f1afdcad1 up to, but not including, 708fd522b86d2a9544c34ec6a86fa3fc23336525; 59b37fe52f49955791a460752c37145f1afdcad1 up to, but not including, 0f67015d72627bad72da3c2084352e0aa134416b; 59b37fe52f49955791a460752c37145f1afdcad1 up to, but not including, d42e6c20de6192f8e4ab4cf10be8c694ef27e8cb; e47ce4f11e26fa3ea99b09521da8b3ac3a7b578d; and 5 more ranges | f7e0231eeaa33245c649fac0303cf97209605446, 407047893a64399f2d2390ff35cc6061107d805d, a6b0cb523eaa01efe8a3f76ced493ba60674c6e6, 9433a5f437b0948d6a2d8a02ad7a42ab7ca27a61, 708fd522b86d2a9544c34ec6a86fa3fc23336525, 0f67015d72627bad72da3c2084352e0aa134416b |
| Siemens | SIMATIC CN 4100 | before V5.0 | V5.0 |
| Linux | Linux Kernel | 5.10.180 up to, but not including, 5.10.210; 5.15.111 up to, but not including, 5.15.190; 6.1.28 up to, but not including, 6.1.149; 6.2.15 up to, but not including, 6.6.101; 6.7 up to, but not including, 6.12.41; 6.13 up to, but not including, 6.15.9; 6.16 | 5.10.210, 5.15.190, 6.1.149, 6.6.101, 6.12.41, 6.15.9 |
| Debian | Debian Linux | 11.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.1 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
More Exposure of Resource to Wrong Sphere vulnerabilities (CWE-668)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/0f67015d72627bad72da3c2084352e0aa134416b
- git.kernel.org/stable/c/407047893a64399f2d2390ff35cc6061107d805d
- git.kernel.org/stable/c/708fd522b86d2a9544c34ec6a86fa3fc23336525
- git.kernel.org/stable/c/9433a5f437b0948d6a2d8a02ad7a42ab7ca27a61
- git.kernel.org/stable/c/a6b0cb523eaa01efe8a3f76ced493ba60674c6e6
- git.kernel.org/stable/c/d42e6c20de6192f8e4ab4cf10be8c694ef27e8cb
- git.kernel.org/stable/c/f7e0231eeaa33245c649fac0303cf97209605446
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlThird Party Advisory
Other references
Recent Exposure of Resource to Wrong Sphere vulnerabilities
- 9.3 Critical severity
- 7.1 High severity
- 7.8 High severity
- 9.0 Critical severity
- 10.0 Critical severity
- 7.1 High severity
Spotted an error? Tell us.