CVE-2025-38049 is a vulnerability identified in the Linux kernel's resctrl subsystem, specifically affecting the x86 architecture's resource control (resctrl) feature. The resctrl interface is used to allocate and manage Cache Allocation Technology (CAT) Closely Linked Operating System Domains (CLOSIDs), which are identifiers used to control and monitor cache occupancy for performance and security purposes. The vulnerability arises from a NULL pointer dereference triggered during the allocation of the 'cleanest' CLOSID on platforms that lack LLC (Last Level Cache) occupancy counters. The kernel code added logic to select the CLOSID with the fewest dirty cache lines by reading these counters, but it failed to account for platforms without such counters. On these platforms, the array that should hold occupancy data is never allocated (due to dom_data_init() not initializing it), leading to a NULL pointer dereference when the kernel attempts to access it during control group creation. This results in a kernel crash (denial of service) when creating new resctrl control groups on affected systems. The patch corrects this by adding a check to skip the allocation logic on platforms without cache occupancy monitors, preventing the NULL dereference. This vulnerability is specific to certain Linux kernel versions containing the faulty commit (6eac36bb9eb0...) and affects systems using the resctrl feature on x86 architectures without LLC occupancy counters. No known exploits are reported in the wild as of the publication date. The issue primarily impacts system stability and availability rather than confidentiality or integrity, as it causes kernel crashes rather than privilege escalation or data leakage.

For European organizations, the impact of CVE-2025-38049 centers on system availability and operational continuity. Organizations running Linux servers or infrastructure that utilize the resctrl feature on affected kernel versions may experience kernel panics or crashes when creating new control groups, potentially disrupting services or automated workflows that rely on resource control groups. This can affect data centers, cloud providers, and enterprises using Linux-based virtualization or containerization technologies that leverage resctrl for performance isolation or security. While the vulnerability does not directly expose data or allow privilege escalation, denial of service conditions in critical infrastructure can lead to downtime, impacting business operations and service level agreements. European organizations with high reliance on Linux servers in sectors such as finance, telecommunications, manufacturing, and government could face operational risks if their systems are affected and unpatched. The lack of known exploits reduces immediate threat but does not eliminate risk, especially if attackers develop denial of service techniques targeting this flaw. Additionally, organizations with compliance requirements for system availability and stability must address this vulnerability promptly to avoid regulatory or contractual issues.

To mitigate CVE-2025-38049, European organizations should: 1) Identify Linux systems running kernel versions containing the vulnerable commit (notably those based on or including commit 6eac36bb9eb0). 2) Apply the official Linux kernel patches or upgrade to a kernel version where the vulnerability is resolved. This is the most effective mitigation. 3) For systems where immediate patching is not feasible, avoid using the resctrl feature or refrain from creating new resctrl control groups on affected platforms, especially those lacking LLC occupancy counters. 4) Implement monitoring to detect kernel crashes or panics related to resctrl operations to enable rapid incident response. 5) Validate system architecture and hardware capabilities to understand if the platform lacks LLC occupancy counters, as this determines exposure. 6) Coordinate with Linux distribution vendors for backported patches and security advisories to ensure timely updates. 7) Review and test kernel updates in staging environments to prevent unintended disruptions. 8) Document and communicate the mitigation steps internally to system administrators and DevOps teams managing Linux infrastructure.