CVE-2025-38733

A flaw was found in the Linux kernel. Due to an incorrect identity mapping of the lowcore, a critical memory region, NULL pointer accesses may succeed instead of causing an exception. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by triggering a system crash.

A low impact flaw was found in the Linux kernel on the s390 architecture. Because the kernel's identity mapping is pinned to address zero, the lowcore, a critical s390 memory region, was always also mapped at address zero regardless of the relocate_lowcore kernel command-line option; when that option is specified the lowcore is even mapped twice. As a result, NULL pointer accesses could succeed instead of causing an exception, since low-address protection still applies but only covers parts of the lowcore. A local attacker able to trigger such an access could use this flaw to cause a denial of service by crashing the system. The vulnerable code is present in the kernel and kernel-rt packages of Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 and in the kernel package of Red Hat In-Vehicle OS 1. For these affected products the fix is deferred to a future update, as the flaw is assessed as low impact, requires local access, and is limited to the s390 architecture; the residual risk is that a local user on an affected s390 system could trigger a system crash until a fix is delivered. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. Red Hat rates this flaw Low severity (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this is lower than the CVE.org score of 7.8 (Important) because Red Hat's assessment reflects availability-only impact on s390 systems, while the CVE.org vector also claims high confidentiality and integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.