CVE-2025-38067: rseq: Fix segfault on registration when rseq_cs is non-zero

Published Jun 18, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

rseq: Fix segfault on registration when rseqcs is non-zero

The rseqcs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseqcs field doesn't point to a valid struct rseqcs.

The correct solution to this would be to fail the rseq registration when the rseqcs field is non-zero. However, some older versions of glibc will reuse the rseq area of previous threads without clearing the rseqcs field and will also terminate the process if the rseq registration fails in a secondary thread. This wasn't caught in testing because in this case the leftover rseqcs does point to a valid struct rseqcs.

What we can do is clear the rseqcs field on registration when it's non-zero which will prevent segfaults on registration and won't break the glibc versions that reuse rseq areas on thread creation.

Affected Software

10 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=4.18<5.10.240
Linux Linux kernel>=5.11<5.15.189
Linux Linux kernel>=5.16<6.1.146
Linux Linux kernel>=6.2<6.6.99
Linux Linux kernel>=6.7<6.12.39
Linux Linux kernel>=6.13<6.14.9
Debian Debian Linux=11.0
Microsoft azl3 kernel 6.6.96.2-2
Microsoft cbl2 kernel 5.15.186.1-1

Event History

Jun 18, 2025
CVE Published
via MITRE·09:33 AM
Data Sourced
via MITRE·09:33 AM
Description
Data Sourced
via NVD·10:15 AM
RemedyDescriptionSeverityAffected Software
Sep 4, 2025
Data Sourced
via Microsoft·08:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:00 AM
Affected Software
Updated
via Microsoft·08:00 AM
Affected Software
Updated
via Microsoft·08:00 AM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2025-38067?

CVE-2025-38067 is classified as a moderate severity vulnerability in the Linux kernel due to its impact on system stability.

2

How do I fix CVE-2025-38067?

To fix CVE-2025-38067, update to the latest version of the Linux kernel where the vulnerability has been patched.

3

What systems are affected by CVE-2025-38067?

CVE-2025-38067 affects various versions of the Linux kernel that utilize the rseq feature.

4

Can CVE-2025-38067 cause system crashes?

Yes, CVE-2025-38067 can potentially cause segmentation faults leading to system crashes during the registration process.

5

Is user action required to trigger CVE-2025-38067?

User-space applications that improperly set the rseq_cs field prior to registration can trigger CVE-2025-38067.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203