CVE-2025-38088

A denial-of-service vulnerability has been identified in the Linux kernel, stemming from an out-of-bounds overflow. This flaw occurs when the requested memory mapping region size exceeds the allocated region size. An attacker can exploit this by crafting a specially designed file, which, when processed by the kernel, could trigger an overflow. This leads to a system crash, impacting the availability of the affected system.

This vulnerability is rated as Moderate severity because exploitation is restricted to local users on bare-metal IBM Power (PowerNV) systems and requires interaction with kernel debugfs interfaces. The flaw cannot be leveraged remotely across the network, and the affected memory tracing component is not enabled or present on virtualized guests or other processor architectures. As a result, the attack surface is limited to specific hardware environments with local access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.