Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38320— arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于regs_get_kernel_stack_nth函数中栈越界读取，可能导致内存损坏。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.21% · P11

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 0a8ea52c3eb157dd65e224fc95b7c9c99fcba9f7< 64773b3ea09235168a549a195cba43bb867c4a17 affected
0a8ea52c3eb157dd65e224fc95b7c9c99fcba9f7< 67abac27d806e8f9d4226ec1528540cf73af673a affected
0a8ea52c3eb157dd65e224fc95b7c9c99fcba9f7< 92750bfe7b0d8dbcaf578c091a65eda1c5f9ad38 affected
0a8ea52c3eb157dd65e224fc95b7c9c99fcba9f7< 01f91d415a8375d85e0c7d3615cd4a168308bb7c affected
0a8ea52c3eb157dd65e224fc95b7c9c99fcba9f7< 21da6d3561f373898349ca7167c9811c020da695 affected
0a8ea52c3eb157dd65e224fc95b7c9c99fcba9f7< 22f935bc86bdfbde04009f05eee191d220cd8c89 affected
0a8ea52c3eb157dd65e224fc95b7c9c99fcba9f7< 422e565b7889ebfd9c8705a3fc786642afe61fca affected
0a8ea52c3eb157dd65e224fc95b7c9c99fcba9f7< 39dfc971e42d886e7df01371cd1bef505076d84c affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38320

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() KASAN reports a stack-out-of-bounds read in regs_get_kernel_stack_nth(). Call Trace: [ 97.283505] BUG: KASAN: stack-out-of-bounds in regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.284677] Read of size 8 at addr ffff800089277c10 by task 1.sh/2550 [ 97.285732] [ 97.286067] CPU: 7 PID: 2550 Comm: 1.sh Not tainted 6.6.0+ #11 [ 97.287032] Hardware name: linux,dummy-virt (DT) [ 97.287815] Call trace: [ 97.288279] dump_backtrace+0xa0/0x128 [ 97.288946] show_stack+0x20/0x38 [ 97.289551] dump_stack_lvl+0x78/0xc8 [ 97.290203] print_address_description.constprop.0+0x84/0x3c8 [ 97.291159] print_report+0xb0/0x280 [ 97.291792] kasan_report+0x84/0xd0 [ 97.292421] __asan_load8+0x9c/0xc0 [ 97.293042] regs_get_kernel_stack_nth+0xa8/0xc8 [ 97.293835] process_fetch_insn+0x770/0xa30 [ 97.294562] kprobe_trace_func+0x254/0x3b0 [ 97.295271] kprobe_dispatcher+0x98/0xe0 [ 97.295955] kprobe_breakpoint_handler+0x1b0/0x210 [ 97.296774] call_break_hook+0xc4/0x100 [ 97.297451] brk_handler+0x24/0x78 [ 97.298073] do_debug_exception+0xac/0x178 [ 97.298785] el1_dbg+0x70/0x90 [ 97.299344] el1h_64_sync_handler+0xcc/0xe8 [ 97.300066] el1h_64_sync+0x78/0x80 [ 97.300699] kernel_clone+0x0/0x500 [ 97.301331] __arm64_sys_clone+0x70/0x90 [ 97.302084] invoke_syscall+0x68/0x198 [ 97.302746] el0_svc_common.constprop.0+0x11c/0x150 [ 97.303569] do_el0_svc+0x38/0x50 [ 97.304164] el0_svc+0x44/0x1d8 [ 97.304749] el0t_64_sync_handler+0x100/0x130 [ 97.305500] el0t_64_sync+0x188/0x190 [ 97.306151] [ 97.306475] The buggy address belongs to stack of task 1.sh/2550 [ 97.307461] and is located at offset 0 in frame: [ 97.308257] __se_sys_clone+0x0/0x138 [ 97.308910] [ 97.309241] This frame has 1 object: [ 97.309873] [48, 184) 'args' [ 97.309876] [ 97.310749] The buggy address belongs to the virtual mapping at [ 97.310749] [ffff800089270000, ffff800089279000) created by: [ 97.310749] dup_task_struct+0xc0/0x2e8 [ 97.313347] [ 97.313674] The buggy address belongs to the physical page: [ 97.314604] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14f69a [ 97.315885] flags: 0x15ffffe00000000(node=1|zone=2|lastcpupid=0xfffff) [ 97.316957] raw: 015ffffe00000000 0000000000000000 dead000000000122 0000000000000000 [ 97.318207] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 97.319445] page dumped because: kasan: bad access detected [ 97.320371] [ 97.320694] Memory state around the buggy address: [ 97.321511] ffff800089277b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.322681] ffff800089277b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 97.323846] >ffff800089277c00: 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00 00 [ 97.325023] ^ [ 97.325683] ffff800089277c80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 [ 97.326856] ffff800089277d00: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 This issue seems to be related to the behavior of some gcc compilers and was also fixed on the s390 architecture before: commit d93a855c31b7 ("s390/ptrace: Avoid KASAN false positives in regs_get_kernel_stack_nth()") As described in that commit, regs_get_kernel_stack_nth() has confirmed that `addr` is on the stack, so reading the value at `*addr` should be allowed. Use READ_ONCE_NOCHECK() helper to silence the KASAN check for this case. [will: Use '*addr' as the argument to READ_ONCE_NOCHECK()]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于regs_get_kernel_stack_nth函数中栈越界读取，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0a8ea52c3eb157dd65e224fc95b7c9c99fcba9f7 ~ 64773b3ea09235168a549a195cba43bb867c4a17 -
Linux Linux 4.8 -

II. Public POCs for CVE-2025-38320

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38320

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-07-10 · 84 CVEs total

CVE-2025-38325 9.8 CRITICAL ksmbd: add free_transport ops in ksmbd connection
CVE-2025-38291 8.8 HIGH wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash
CVE-2025-38292 8.8 HIGH wifi: ath12k: fix invalid access to memory
CVE-2025-38283 8.8 HIGH hisi_acc_vfio_pci: bugfix live migration function without VF device driver
CVE-2025-38293 8.8 HIGH wifi: ath11k: fix node corruption in ar->arvifs list
CVE-2025-38290 8.8 HIGH wifi: ath12k: fix node corruption in ar->arvifs list
CVE-2025-38343 8.3 HIGH wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
CVE-2025-38303 7.8 HIGH Bluetooth: eir: Fix possible crashes on eir_create_adv_data
CVE-2025-38333 7.8 HIGH f2fs: fix to bail out in get_new_segment()
CVE-2025-38321 7.8 HIGH smb: Log an error when close_all_cached_dirs fails
CVE-2025-38339 7.8 HIGH powerpc/bpf: fix JIT code size calculation of bpf trampoline
CVE-2025-38317 7.8 HIGH wifi: ath12k: Fix buffer overflow in debugfs
CVE-2025-38306 7.8 HIGH fs/fhandle.c: fix a race in call of has_locked_children()
CVE-2025-38278 7.8 HIGH octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
CVE-2025-38341 7.8 HIGH eth: fbnic: avoid double free when failing to DMA-map FW msg
CVE-2025-38346 7.8 HIGH ftrace: Fix UAF when lookup kallsym after ftrace disabled
CVE-2025-38273 7.8 HIGH net: tipc: fix refcount warning in tipc_aead_encrypt
CVE-2025-38276 7.8 HIGH fs/dax: Fix "don't skip locked entries when scanning entries"
CVE-2025-38270 7.8 HIGH net: drv: netdevsim: don't napi_complete() from netpoll
CVE-2025-38331 7.5 HIGH net: ethernet: cortina: Use TOE/TSO on all TCP

Showing top 20 of 84 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38320

No comments yet

Leave a comment