CVE-2025-38298: EDAC/skx_common: Fix general protection fault
In the Linux kernel, the following vulnerability has been resolved:
EDAC/skxcommon: Fix general protection fault
After loading i10nmedac (which automatically loads skxedaccommon), if unload only i10nmedac, then reload it and perform error injection testing, a general protection fault may occur:
mce: [Hardware Error]: Machine check events logged Oops: general protection fault ... ... Workqueue: events mcegenpoolprocess RIP: 0010:string+0x53/0xe0 ... Call Trace: <TASK> ? dieaddr+0x37/0x90 ? excgeneralprotection+0x1e7/0x3f0 ? asmexcgeneralprotection+0x26/0x30 ? string+0x53/0xe0 vsnprintf+0x23e/0x4c0 snprintf+0x4d/0x70 skxadxldecode+0x16a/0x330 [skxedaccommon] skxmcecheckerror.part.0+0xf8/0x220 [skxedaccommon] skxmcecheckerror+0x17/0x20 [skxedaccommon] ...
The issue arose was because the variable 'adxlcomponentcount' (inside skxedaccommon), which counts the ADXL components, was not reset. During the reloading of i10nmedac, the count was incremented by the actual number of ADXL components again, resulting in a count that was double the real number of ADXL components. This led to an out-of-bounds reference to the ADXL component array, causing the general protection fault above.
Fix this issue by resetting the 'adxlcomponentcount' in adxlput(), which is called during the unloading of {skx,i10nm}edac.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38298?
CVE-2025-38298 has been classified with a high severity due to its potential to cause a general protection fault in the Linux kernel.
How do I fix CVE-2025-38298?
To fix CVE-2025-38298, ensure that you are running the latest version of the Linux kernel where this vulnerability has been addressed.
Which versions of the Linux kernel are affected by CVE-2025-38298?
CVE-2025-38298 affects certain versions of the Linux kernel that utilize the EDAC (Error Detection and Correction) feature.
What is the nature of CVE-2025-38298?
CVE-2025-38298 is a vulnerability related to an improper handling of error injection testing in the Linux kernel's EDAC subsystem.
Can CVE-2025-38298 be exploited remotely?
CVE-2025-38298 primarily affects local operations and is not considered remote exploit due to the nature of the general protection fault.