VulnerabilityPublished 3 Jul 2025Updated 5 Nov 2026

CVE-2025-38100: Linux kernel · x86/iopl: Cure TIF_IO_BITMAP inconsistencies

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in d64b7b05a827f98d068f412969eef65489b0cf03 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 21:04 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in d64b7b05a827f98d068f412969eef65489b0cf03, b3b3b6366dc8eb5b22edba9adc4bff3cdacfd64c, aa5ce1485562f20235b4c759eee5ab0c41d2c220 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ ea5f1cd7ab494f65f50f338299eabb40ad6a1767, < d64b7b05a827f98d068f412969eef65489b0cf03	Fixed in d64b7b05a827f98d068f412969eef65489b0cf03
LinuxLinux	Affected ≥ ea5f1cd7ab494f65f50f338299eabb40ad6a1767, < b3b3b6366dc8eb5b22edba9adc4bff3cdacfd64c	Fixed in b3b3b6366dc8eb5b22edba9adc4bff3cdacfd64c
LinuxLinux	Affected ≥ ea5f1cd7ab494f65f50f338299eabb40ad6a1767, < aa5ce1485562f20235b4c759eee5ab0c41d2c220	Fixed in aa5ce1485562f20235b4c759eee5ab0c41d2c220
LinuxLinux	Affected ≥ ea5f1cd7ab494f65f50f338299eabb40ad6a1767, < 73cfcc8445585b8af7e18be3c9246b851fdf336c	Fixed in 73cfcc8445585b8af7e18be3c9246b851fdf336c
LinuxLinux	Affected ≥ ea5f1cd7ab494f65f50f338299eabb40ad6a1767, < 8b68e978718f14fdcb080c2a7791c52a0d09bc6d	Fixed in 8b68e978718f14fdcb080c2a7791c52a0d09bc6d
LinuxLinux	Affected ≥ ea5f1cd7ab494f65f50f338299eabb40ad6a1767, < 2dace5e016c991424a3dc6e83b1ae5dca8992d08	Fixed in 2dace5e016c991424a3dc6e83b1ae5dca8992d08

Description

In the Linux kernel, the following vulnerability has been resolved: x86/iopl: Cure TIF_IO_BITMAP inconsistencies io_bitmap_exit() is invoked from exit_thread() when a task exists or when a fork fails. In the latter case the exit_thread() cleans up resources which were allocated during fork(). io_bitmap_exit() invokes task_update_io_bitmap(), which in turn ends up in tss_update_io_bitmap(). tss_update_io_bitmap() operates on the current task. If current has TIF_IO_BITMAP set, but no bitmap installed, tss_update_io_bitmap() crashes with a NULL pointer dereference. There are two issues, which lead to that problem: 1) io_bitmap_exit() should not invoke task_update_io_bitmap() when the task, which is cleaned up, is not the current task. That's a clear indicator for a cleanup after a failed fork(). 2) A task should not have TIF_IO_BITMAP set and neither a bitmap installed nor IOPL emulation level 3 activated. This happens when a kernel thread is created in the context of a user space thread, which has TIF_IO_BITMAP set as the thread flags are copied and the IO bitmap pointer is cleared. Other than in the failed fork() case this has no impact because kernel threads including IO workers never return to user space and therefore never invoke tss_update_io_bitmap(). Cure this by adding the missing cleanups and checks: 1) Prevent io_bitmap_exit() to invoke task_update_io_bitmap() if the to be cleaned up task is not the current task. 2) Clear TIF_IO_BITMAP in copy_thread() unconditionally. For user space forks it is set later, when the IO bitmap is inherited in io_bitmap_share(). For paranoia sake, add a warning into tss_update_io_bitmap() to catch the case, when that code is invoked with inconsistent state.

References

Community reviews

Loading reviews…