CVE-2025-38383

A flaw was found in the Linux kernel. A data race vulnerability exists in the show_numa_info() function within the mm/vmalloc component. This occurs because the m->private memory is accessible to multiple central processing units (CPUs) simultaneously, leading to inconsistent data reads and writes. A local attacker could exploit this to cause a system crash or other unpredictable behavior, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploitation requires local access and precise timing during concurrent reads of the vmalloc procfs interface, with the primary blast radius limited to a system crash. The underlying flaw involves concurrent CPU handling of shared sequential file state in kernel memory management routines, which is not present in the default kernels of Red Hat Enterprise Linux 8 and 9. An unprivileged local user must deliberately trigger simultaneous access across multiple processors to induce the race, reducing the practical likelihood of arbitrary system compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.