CVE-2025-38408

A flaw was found in the Linux kernel. Improper initialization of internal pointers in the genirq/irq_sim module can lead to incorrect memory access. A local attacker with low privileges could exploit this, potentially causing a denial of service (DoS) by making the system crash.

A flaw was found in the Linux kernel's genirq/irq_sim module, rated by Red Hat as moderate impact, affecting the kernel and kernel-rt components of Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10. The irq_sim simulation work context was allocated with kmalloc() instead of kzalloc(), leaving the pointers of the ops member with uninitialized, random content that can be invalidly dereferenced, causing incorrect memory access. A local attacker could exploit this improper pointer initialization to crash the system, resulting in a denial of service. Red Hat Enterprise Linux 6, 7, and 8, and Red Hat In-Vehicle OS 1 are not affected because the vulnerable code is not present in those products. Red Hat rates this flaw lower (CVSS 4.1) than NIST (5.5) because exploitation requires local access with high privileges and is difficult to perform, and the impact is limited to system availability. Fixes for the affected Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 streams are deferred, so no fix is currently planned for these streams; the residual risk is a local denial of service, with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.