CVE-2025-32438: Local privilege escalation in make-initrd-ng
make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable enabled (the default) a local user is able to create a program that will be executed by root during shutdown. Patches exist for NixOS 24.11 and 25.05 / unstable. As a workaround, set systemd.shutdownRamfs.enable = false;.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32438?
CVE-2025-32438 has been identified as a local privilege escalation vulnerability affecting all NixOS users.
How can I mitigate CVE-2025-32438?
To mitigate CVE-2025-32438, ensure that the systemd.shutdownRamfs.enable option is disabled or apply the patches provided by NixOS.
Which versions of NixOS make-initrd-ng are affected by CVE-2025-32438?
CVE-2025-32438 affects NixOS make-initrd-ng versions from 24.11 up to but not including 25.05.
Who is affected by CVE-2025-32438?
All users of NixOS who have the make-initrd-ng utility and the default setting for systemd.shutdownRamfs.enable are affected by CVE-2025-32438.
Can I report my findings regarding CVE-2025-32438?
Yes, users can report their findings or any issues related to CVE-2025-32438 to the NixOS security team through their designated channels.