CVE-2025-38049

x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors

MEDIUM
5.5
CVSS Score
Published: April 18, 2025 at 07:01 AM UTC
Updated: June 17, 2026 at 09:15 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors Commit 6eac36bb9eb0 ("x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid") added logic that causes resctrl to search for the CLOSID with the fewest dirty cache lines when creating a new control group, if requested by the arch code. This depends on the values read from the llc_occupancy counters. The logic is applicable to architectures where the CLOSID effectively forms part of the monitoring identifier and so do not allow complete freedom to choose an unused monitoring identifier for a given CLOSID. This support missed that some platforms may not have these counters. This causes a NULL pointer dereference when creating a new control group as the array was not allocated by dom_data_init(). As this feature isn't necessary on platforms that don't have cache occupancy monitors, add this to the check that occurs when a new control group is allocated.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.13 ≤ v < 6.13.116.14 ≤ v < 6.14.26.9 ≤ v < 6.12.236.9 ≤ v < 6.13.116.9 ≤ v < 6.14.26.9 ≤ v < 6.156.96eac36bb9eb0349c983313c71692c19d50b56878
Vendor states this is fixed in 93a418fc61da13d1ee4047d4d1327990f7a2816a (fixed)
Vendor states this is fixed in a121798ae669351ec0697c94f71c3a692b2a755b (fixed)
Vendor states this is fixed in a8a1bcc27d4607227088d80483164289b5348293 (fixed)
Vendor states this is fixed in ed5addb55e403ad6598102bcf546e068ae01fef6 (fixed)
Vendor states this is fixed in 6.12.23 (unaffected)
Vendor states this is fixed in 6.13.11 (unaffected)
Vendor states this is fixed in 6.14.2 (unaffected)
Vendor states this is fixed in 6.15 (unaffected)
Vendor states this is fixed in 6.9 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/93a418fc61da13d1ee4047d4d1327990f7a2816a
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a121798ae669351ec0697c94f71c3a692b2a755b
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a8a1bcc27d4607227088d80483164289b5348293
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ed5addb55e403ad6598102bcf546e068ae01fef6

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUMCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card