CVE-2025-38466

A flaw was found in the Linux kernel's uprobes functionality. A local attacker with elevated privileges could exploit this vulnerability by using uprobes destructively in the middle of an instruction. This is possible because the kernel incorrectly validates instructions, potentially mistaking data for executable code on some architectures. Successful exploitation could lead to a denial of service (DoS) on the affected system.

A moderate severity denial of service vulnerability was found in the Linux kernel's uprobes functionality, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 and the kernel package in Red Hat In-Vehicle OS 1. When placing a uprobe, the kernel only verifies that a valid instruction exists at the requested offset; because of variable instruction length it cannot determine whether that offset is an instruction boundary in the intended execution stream, and on architectures that mix data in the text segment, such as arm64, a data word can be mistaken for an instruction. A local attacker who already holds elevated privileges (for example the CAP_SYS_ADMIN or CAP_PERFMON capability) could exploit this by attaching uprobes in the middle of an instruction and using them destructively, causing a denial of service on the affected system. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are not affected because the vulnerable code is not present in those releases. Red Hat assesses the impact of this flaw as Moderate (CVSS 4.4): successful exploitation requires an already highly privileged local user and the consequences are limited to system availability. This differs from the higher upstream CVE.org score of 7.8, which assumes lower privileges and confidentiality and integrity impact that the technical evidence for this flaw does not support. Because the flaw requires pre-existing elevated privileges and results only in denial of service, fixes for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams have been deferred; the residual risk is that a privileged local user could crash the affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.