Riskcovery

CVE-2025-38071

x86/mm: Check return value from memblock_phys_alloc_range()

State
Published
Severity
Not scored
Published
Jun 18, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Check return value from memblock_phys_alloc_range()

At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblock_phys_alloc_range() returns 0 on failure, which leads memblock_phys_free() to throw the first 4 MiB of physical memory to the wolves.

At a minimum it should fail gracefully with a meaningful diagnostic, but in fact everything seems to work fine without the weird reserve allocation.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • a7259df7670240ee03b0cfce8a3e5d3773911e24 to before 8c18c904d301ffeb33b071eadc55cd6131e1e9beAffected
  • a7259df7670240ee03b0cfce8a3e5d3773911e24 to before bffd5f2815c5234d609725cd0dc2f4bc5de2fc67Affected
  • a7259df7670240ee03b0cfce8a3e5d3773911e24 to before c6f2694c580c27dca0cf7546ee9b4bfa6b940e38Affected
  • a7259df7670240ee03b0cfce8a3e5d3773911e24 to before dde4800d2b0f68b945fd81d4fc2d4a10ae25f743Affected
  • a7259df7670240ee03b0cfce8a3e5d3773911e24 to before 631ca8909fd5c62b9fda9edda93924311a78a9c4Affected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 6.1.141 through 6.1.*Not affected
  • 6.6.93 through 6.6.*Not affected
  • 6.12.31 through 6.12.*Not affected
  • 6.14.9 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.