VulnerabilityPublished 10 Jul 2025Updated 5 Nov 2026

CVE-2025-38334: Linux kernel · x86/sgx: Prevent attempts to reclaim poisoned pages

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ed16618c380c32c68c06186d0ccbb0d5e0586e59 : patch Linux kernel soon.

Data as of 5 Nov 2026, 21:33 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in ed16618c380c32c68c06186d0ccbb0d5e0586e59, dc5de5bd6deabd327ced2b2b1d0b4f14cd146afe, 62b62a2a6dc51ed6e8e334861f04220c9cf8106a +2

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 70d3b8ddcd20d3c859676f56c43c7b2360c70266, < ed16618c380c32c68c06186d0ccbb0d5e0586e59	Fixed in ed16618c380c32c68c06186d0ccbb0d5e0586e59
LinuxLinux	Affected ≥ 70d3b8ddcd20d3c859676f56c43c7b2360c70266, < dc5de5bd6deabd327ced2b2b1d0b4f14cd146afe	Fixed in dc5de5bd6deabd327ced2b2b1d0b4f14cd146afe
LinuxLinux	Affected ≥ 70d3b8ddcd20d3c859676f56c43c7b2360c70266, < 62b62a2a6dc51ed6e8e334861f04220c9cf8106a	Fixed in 62b62a2a6dc51ed6e8e334861f04220c9cf8106a
LinuxLinux	Affected ≥ 70d3b8ddcd20d3c859676f56c43c7b2360c70266, < 31dcbac94bfeabb86bf85b0c36803fdd6536437b	Fixed in 31dcbac94bfeabb86bf85b0c36803fdd6536437b
LinuxLinux	Affected ≥ 70d3b8ddcd20d3c859676f56c43c7b2360c70266, < 00a88e9ea1b170d579c56327c38f7e8cf689df87	Fixed in 00a88e9ea1b170d579c56327c38f7e8cf689df87
LinuxLinux	Affected =5.11	Fixed in–

AI-suggested

A fix is available and has been applied in the Linux kernel source (commits ed16618c380c32c68c06186d0ccbb0d5e0586e59 and others). Systems running affected versions should update to a fixed kernel version incorporating these patches. No additional mitigation is required beyond applying the official fix.

Description

CVE-2025-38334 is a vulnerability in the Linux kernel's SGX (Software Guard Extensions) implementation where poisoned EPC pages could be incorrectly reclaimed. This flaw could cause kernel panics due to machine check exceptions triggered by microcode operations on poisoned pages. The issue is fixed by preventing attempts to reclaim poisoned pages, removing them from the active reclaim list upon memory failure notification.

Impact

Attempting to reclaim poisoned SGX EPC pages can cause machine check exceptions that lead to core shutdowns and kernel panics, resulting in system instability or denial of service. Additionally, poisoned pages could be mistakenly reused in other enclaves, potentially compromising enclave integrity. The vulnerability affects Linux kernel version 5.11 and could cause critical system failures if triggered.

Summary

The vulnerability involves the Linux kernel's handling of SGX EPC pages that have been marked as poisoned due to memory errors. The kernel's SGX page reclaim logic does not check the poison status of EPC pages before attempting to reclaim them. Reclaiming poisoned pages involves microcode instructions that cannot gracefully handle machine check exceptions (MCEs), leading to core shutdowns and kernel panics. The fix involves calling sgx_unmark_page_reclaimable() to remove poisoned pages from the sgx_active_page_list, preventing their reclamation and subsequent kernel instability. This change addresses the issue by ensuring poisoned pages are not reused or reclaimed, mitigating the risk of system crashes.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 21:33 UTC

Technical details

References

Community reviews

Related threats