ghsa-627j-hqc4-995q
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
rseq: Fix segfault on registration when rseq_cs is non-zero
The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseq_cs field doesn't point to a valid struct rseq_cs.
The correct solution to this would be to fail the rseq registration when the rseq_cs field is non-zero. However, some older versions of glibc will reuse the rseq area of previous threads without clearing the rseq_cs field and will also terminate the process if the rseq registration fails in a secondary thread. This wasn't caught in testing because in this case the leftover rseq_cs does point to a valid struct rseq_cs.
What we can do is clear the rseq_cs field on registration when it's non-zero which will prevent segfaults on registration and won't break the glibc versions that reuse rseq areas on thread creation.
{
"affected": [],
"aliases": [
"CVE-2025-38067"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-18T10:15:39Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrseq: Fix segfault on registration when rseq_cs is non-zero\n\nThe rseq_cs field is documented as being set to 0 by user-space prior to\nregistration, however this is not currently enforced by the kernel. This\ncan result in a segfault on return to user-space if the value stored in\nthe rseq_cs field doesn\u0027t point to a valid struct rseq_cs.\n\nThe correct solution to this would be to fail the rseq registration when\nthe rseq_cs field is non-zero. However, some older versions of glibc\nwill reuse the rseq area of previous threads without clearing the\nrseq_cs field and will also terminate the process if the rseq\nregistration fails in a secondary thread. This wasn\u0027t caught in testing\nbecause in this case the leftover rseq_cs does point to a valid struct\nrseq_cs.\n\nWhat we can do is clear the rseq_cs field on registration when it\u0027s\nnon-zero which will prevent segfaults on registration and won\u0027t break\nthe glibc versions that reuse rseq areas on thread creation.",
"id": "GHSA-627j-hqc4-995q",
"modified": "2025-07-17T18:31:09Z",
"published": "2025-06-18T12:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38067"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2df285dab00fa03a3ef939b6cb0d0d0aeb0791db"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3e4028ef31b69286c9d4878cee0330235f53f218"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/48900d839a3454050fd5822e34be8d54c4ec9b86"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b2b05d0dc2f4f0646922068af435aed5763d16ba"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eaf112069a904b6207b4106ff083e0208232a2eb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f004f58d18a2d3dc761cf973ad27b4a5997bd876"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fd881d0a085fc54354414aed990ccf05f282ba53"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.