CVE-2025-38049
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
18/04/2025
Last modified:
01/10/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors<br />
<br />
Commit<br />
<br />
6eac36bb9eb0 ("x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid")<br />
<br />
added logic that causes resctrl to search for the CLOSID with the fewest dirty<br />
cache lines when creating a new control group, if requested by the arch code.<br />
This depends on the values read from the llc_occupancy counters. The logic is<br />
applicable to architectures where the CLOSID effectively forms part of the<br />
monitoring identifier and so do not allow complete freedom to choose an unused<br />
monitoring identifier for a given CLOSID.<br />
<br />
This support missed that some platforms may not have these counters. This<br />
causes a NULL pointer dereference when creating a new control group as the<br />
array was not allocated by dom_data_init().<br />
<br />
As this feature isn&#39;t necessary on platforms that don&#39;t have cache occupancy<br />
monitors, add this to the check that occurs when a new control group is<br />
allocated.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.9 (including) | 6.12.23 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.13.11 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.14 (including) | 6.14.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



