CVE-2025-38076: alloc_tag: allocate percpu counters for module tags dynamically
In the Linux kernel, the following vulnerability has been resolved:
alloctag: allocate percpu counters for module tags dynamically
When a module gets unloaded it checks whether any of its tags are still in use and if so, we keep the memory containing module's allocation tags alive until all tags are unused. However percpu counters referenced by the tags are freed by freemodule(). This will lead to UAF if the memory allocated by a module is accessed after module was unloaded.
To fix this we allocate percpu counters for module allocation tags dynamically and we keep it alive for tags which are still in use after module unloading. This also removes the requirement of a larger PERCPUMODULERESERVE when memory allocation profiling is enabled because percpu memory for counters does not need to be reserved anymore.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38076?
CVE-2025-38076 is categorized with a severity level that requires prompt attention due to potential security risks associated with memory management in the Linux kernel.
How do I fix CVE-2025-38076?
To fix CVE-2025-38076, ensure that you upgrade to the latest patched version of the Linux kernel that addresses this vulnerability.
What are the potential impacts of CVE-2025-38076?
CVE-2025-38076 could lead to memory leaks and instability in the system if the module's allocation tags are not properly managed upon unloading.
Which versions of the Linux kernel are affected by CVE-2025-38076?
CVE-2025-38076 affects various versions of the Linux kernel prior to the release of the security patch that resolves this issue.
Is CVE-2025-38076 a remote or local vulnerability?
CVE-2025-38076 is considered a local vulnerability that requires access to the system to exploit.