ghsa-mfmj-296r-5fqr
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
powerpc64/ftrace: fix clobbered r15 during livepatching
While r15 is clobbered always with PPC_FTRACE_OUT_OF_LINE, it is not restored in livepatch sequence leading to not so obvious fails like below:
BUG: Unable to handle kernel data access on write at 0xc0000000000f9078 Faulting instruction address: 0xc0000000018ff958 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP: c0000000018ff958 LR: c0000000018ff930 CTR: c0000000009c0790 REGS: c00000005f2e7790 TRAP: 0300 Tainted: G K (6.14.0+) MSR: 8000000000009033 CR: 2822880b XER: 20040000 CFAR: c0000000008addc0 DAR: c0000000000f9078 DSISR: 0a000000 IRQMASK: 1 GPR00: c0000000018f2584 c00000005f2e7a30 c00000000280a900 c000000017ffa488 GPR04: 0000000000000008 0000000000000000 c0000000018f24fc 000000000000000d GPR08: fffffffffffe0000 000000000000000d 0000000000000000 0000000000008000 GPR12: c0000000009c0790 c000000017ffa480 c00000005f2e7c78 c0000000000f9070 GPR16: c00000005f2e7c90 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 c00000005f3efa80 c00000005f2e7c60 c00000005f2e7c88 GPR24: c00000005f2e7c60 0000000000000001 c0000000000f9078 0000000000000000 GPR28: 00007fff97960000 c000000017ffa480 0000000000000000 c0000000000f9078 ... Call Trace: check_heap_object+0x34/0x390 (unreliable) __mutex_unlock_slowpath.isra.0+0xe4/0x230 seq_read_iter+0x430/0xa90 proc_reg_read_iter+0xa4/0x200 vfs_read+0x41c/0x510 ksys_read+0xa4/0x190 system_call_exception+0x1d0/0x440 system_call_vectored_common+0x15c/0x2ec
Fix it by restoring r15 always.
{
"affected": [],
"aliases": [
"CVE-2025-38233"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-04T14:15:32Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc64/ftrace: fix clobbered r15 during livepatching\n\nWhile r15 is clobbered always with PPC_FTRACE_OUT_OF_LINE, it is\nnot restored in livepatch sequence leading to not so obvious fails\nlike below:\n\n BUG: Unable to handle kernel data access on write at 0xc0000000000f9078\n Faulting instruction address: 0xc0000000018ff958\n Oops: Kernel access of bad area, sig: 11 [#1]\n ...\n NIP: c0000000018ff958 LR: c0000000018ff930 CTR: c0000000009c0790\n REGS: c00000005f2e7790 TRAP: 0300 Tainted: G K (6.14.0+)\n MSR: 8000000000009033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e CR: 2822880b XER: 20040000\n CFAR: c0000000008addc0 DAR: c0000000000f9078 DSISR: 0a000000 IRQMASK: 1\n GPR00: c0000000018f2584 c00000005f2e7a30 c00000000280a900 c000000017ffa488\n GPR04: 0000000000000008 0000000000000000 c0000000018f24fc 000000000000000d\n GPR08: fffffffffffe0000 000000000000000d 0000000000000000 0000000000008000\n GPR12: c0000000009c0790 c000000017ffa480 c00000005f2e7c78 c0000000000f9070\n GPR16: c00000005f2e7c90 0000000000000000 0000000000000000 0000000000000000\n GPR20: 0000000000000000 c00000005f3efa80 c00000005f2e7c60 c00000005f2e7c88\n GPR24: c00000005f2e7c60 0000000000000001 c0000000000f9078 0000000000000000\n GPR28: 00007fff97960000 c000000017ffa480 0000000000000000 c0000000000f9078\n ...\n Call Trace:\n check_heap_object+0x34/0x390 (unreliable)\n __mutex_unlock_slowpath.isra.0+0xe4/0x230\n seq_read_iter+0x430/0xa90\n proc_reg_read_iter+0xa4/0x200\n vfs_read+0x41c/0x510\n ksys_read+0xa4/0x190\n system_call_exception+0x1d0/0x440\n system_call_vectored_common+0x15c/0x2ec\n\nFix it by restoring r15 always.",
"id": "GHSA-mfmj-296r-5fqr",
"modified": "2025-07-04T15:31:10Z",
"published": "2025-07-04T15:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38233"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a9212bf5ca640232254b31330e86272fe4073bc9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cb5b691f8273432297611863ac142e17119279e0"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.