CVE-2025-38100

Estado: ModificadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

x86/iopl: Cure TIF_IO_BITMAP inconsistencies

io_bitmap_exit() is invoked from exit_thread() when a task exists or when a fork fails. In the latter case the exit_thread() cleans up resources which were allocated during fork().

io_bitmap_exit() invokes task_update_io_bitmap(), which in turn ends up in tss_update_io_bitmap(). tss_update_io_bitmap() operates on the current task. If current has TIF_IO_BITMAP set, but no bitmap installed, tss_update_io_bitmap() crashes with a NULL pointer dereference.

There are two issues, which lead to that problem:

Leer descripción completaMostrar menos

Cure this by adding the missing cleanups and checks:

For paranoia sake, add a warning into tss_update_io_bitmap() to catch the case, when that code is invoked with inconsistent state.

Detalles técnicos trazas, registros y código del informe original

  1) io_bitmap_exit() should not invoke task_update_io_bitmap() when
     the task, which is cleaned up, is not the current task. That's a
     clear indicator for a cleanup after a failed fork().

  2) A task should not have TIF_IO_BITMAP set and neither a bitmap
     installed nor IOPL emulation level 3 activated.

     This happens when a kernel thread is created in the context of
     a user space thread, which has TIF_IO_BITMAP set as the thread
     flags are copied and the IO bitmap pointer is cleared.

     Other than in the failed fork() case this has no impact because
     kernel threads including IO workers never return to user space and
     therefore never invoke tss_update_io_bitmap().

  1) Prevent io_bitmap_exit() to invoke task_update_io_bitmap() if
     the to be cleaned up task is not the current task.

  2) Clear TIF_IO_BITMAP in copy_thread() unconditionally. For user
     space forks it is set later, when the IO bitmap is inherited in
     io_bitmap_share().

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 5.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.21%
Percentil entre todas las CVEs puntuadas: 10
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Debian — Debian Linux Linux — Linux Kernel

CWE

CWE-476

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-38100",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ea5f1cd7ab494f65f50f338299eabb40ad6a1767",
              "lessThan": "d64b7b05a827f98d068f412969eef65489b0cf03",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea5f1cd7ab494f65f50f338299eabb40ad6a1767",
              "lessThan": "2dace5e016c991424a3dc6e83b1ae5dca8992d08",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea5f1cd7ab494f65f50f338299eabb40ad6a1767",
              "lessThan": "aa5ce1485562f20235b4c759eee5ab0c41d2c220",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea5f1cd7ab494f65f50f338299eabb40ad6a1767",
              "lessThan": "2cfcbe1554c119402e7382de974c26b0549899fe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea5f1cd7ab494f65f50f338299eabb40ad6a1767",
              "lessThan": "b3b3b6366dc8eb5b22edba9adc4bff3cdacfd64c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea5f1cd7ab494f65f50f338299eabb40ad6a1767",
              "lessThan": "73cfcc8445585b8af7e18be3c9246b851fdf336c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea5f1cd7ab494f65f50f338299eabb40ad6a1767",
              "lessThan": "8b68e978718f14fdcb080c2a7791c52a0d09bc6d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/x86/kernel/ioport.c",
            "arch/x86/kernel/process.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/x86/kernel/ioport.c",
            "arch/x86/kernel/process.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
          "versions": [
            {
              "status": "affected",
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
          "versions": [
            {
              "status": "affected",
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
          "versions": [
            {
              "status": "affected",
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "Siemens",
          "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
          "versions": [
            {
              "status": "affected",
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "Siemens",
          "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
          "versions": [
            {
              "status": "affected",
              "version": "V3.1.5",
              "lessThan": "*",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-07-03T09:15:23.437",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2cfcbe1554c119402e7382de974c26b0549899fe",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2dace5e016c991424a3dc6e83b1ae5dca8992d08",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/73cfcc8445585b8af7e18be3c9246b851fdf336c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8b68e978718f14fdcb080c2a7791c52a0d09bc6d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/aa5ce1485562f20235b4c759eee5ab0c41d2c220",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b3b3b6366dc8eb5b22edba9adc4bff3cdacfd64c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d64b7b05a827f98d068f412969eef65489b0cf03",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/iopl: Cure TIF_IO_BITMAP inconsistencies\n\nio_bitmap_exit() is invoked from exit_thread() when a task exists or\nwhen a fork fails. In the latter case the exit_thread() cleans up\nresources which were allocated during fork().\n\nio_bitmap_exit() invokes task_update_io_bitmap(), which in turn ends up\nin tss_update_io_bitmap(). tss_update_io_bitmap() operates on the\ncurrent task. If current has TIF_IO_BITMAP set, but no bitmap installed,\ntss_update_io_bitmap() crashes with a NULL pointer dereference.\n\nThere are two issues, which lead to that problem:\n\n  1) io_bitmap_exit() should not invoke task_update_io_bitmap() when\n     the task, which is cleaned up, is not the current task. That's a\n     clear indicator for a cleanup after a failed fork().\n\n  2) A task should not have TIF_IO_BITMAP set and neither a bitmap\n     installed nor IOPL emulation level 3 activated.\n\n     This happens when a kernel thread is created in the context of\n     a user space thread, which has TIF_IO_BITMAP set as the thread\n     flags are copied and the IO bitmap pointer is cleared.\n\n     Other than in the failed fork() case this has no impact because\n     kernel threads including IO workers never return to user space and\n     therefore never invoke tss_update_io_bitmap().\n\nCure this by adding the missing cleanups and checks:\n\n  1) Prevent io_bitmap_exit() to invoke task_update_io_bitmap() if\n     the to be cleaned up task is not the current task.\n\n  2) Clear TIF_IO_BITMAP in copy_thread() unconditionally. For user\n     space forks it is set later, when the IO bitmap is inherited in\n     io_bitmap_share().\n\nFor paranoia sake, add a warning into tss_update_io_bitmap() to catch\nthe case, when that code is invoked with inconsistent state."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/iopl: Solucionar inconsistencias de TIF_IO_BITMAP. io_bitmap_exit() se invoca desde exit_thread() cuando existe una tarea o cuando falla una bifurcación. En este último caso, exit_thread() limpia los recursos asignados durante fork(). io_bitmap_exit() invoca task_update_io_bitmap(), que a su vez termina en tss_update_io_bitmap(). tss_update_io_bitmap() opera en la tarea actual. Si la tarea actual tiene TIF_IO_BITMAP configurado, pero no hay ningún mapa de bits instalado, tss_update_io_bitmap() se bloquea con una desreferencia de puntero NULL. Hay dos problemas que conducen a este problema: 1) io_bitmap_exit() no debería invocar task_update_io_bitmap() cuando la tarea, que se limpia, no es la tarea actual. Esto es un indicador claro de una limpieza después de un fork() fallido. 2) Una tarea no debe tener TIF_IO_BITMAP establecido ni un mapa de bits instalado ni el nivel de emulación IOPL 3 activado. Esto sucede cuando se crea un hilo del kernel en el contexto de un hilo del espacio de usuario, que tiene TIF_IO_BITMAP establecido a medida que se copian los indicadores del hilo y se borra el puntero del mapa de bits de E/S. Aparte del caso del fork() fallido, esto no tiene impacto porque los hilos del kernel, incluidos los trabajadores de E/S, nunca vuelven al espacio de usuario y, por lo tanto, nunca invocan tss_update_io_bitmap(). Solucione esto añadiendo las limpiezas y comprobaciones que faltan: 1) Evite que io_bitmap_exit() invoque task_update_io_bitmap() si la tarea que se va a limpiar no es la tarea actual. 2) Borre TIF_IO_BITMAP en copy_thread() incondicionalmente. Para las bifurcaciones del espacio de usuario, se establece más tarde, cuando el mapa de bits de E/S se hereda en io_bitmap_share(). Por el bien de la paranoia, agregue una advertencia en tss_update_io_bitmap() para detectar el caso en el que ese código se invoca con un estado inconsistente."
    }
  ],
  "lastModified": "2026-06-17T09:16:03.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3D14F4C-A21E-465D-A928-5CCE684E2B98",
              "versionEndExcluding": "5.10.239",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D96F2C0D-0D4A-4658-AD34-D8A626EA422D",
              "versionEndExcluding": "5.15.186",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "459B4E94-FE0E-434D-B782-95E3A5FFC6B1",
              "versionEndExcluding": "6.1.142",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "304E3F01-7D7A-4908-994E-7F95C5C00B06",
              "versionEndExcluding": "6.6.94",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FFA54AA-CDFE-4591-BD07-72813D0948F4",
              "versionEndExcluding": "6.12.34",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92",
              "versionEndExcluding": "6.15.3",
              "versionStartIncluding": "6.13"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}