CVE-2025-38049

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
18/04/2025
Last modified:
01/10/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors<br /> <br /> Commit<br /> <br /> 6eac36bb9eb0 ("x86/resctrl: Allocate the cleanest CLOSID by searching closid_num_dirty_rmid")<br /> <br /> added logic that causes resctrl to search for the CLOSID with the fewest dirty<br /> cache lines when creating a new control group, if requested by the arch code.<br /> This depends on the values read from the llc_occupancy counters. The logic is<br /> applicable to architectures where the CLOSID effectively forms part of the<br /> monitoring identifier and so do not allow complete freedom to choose an unused<br /> monitoring identifier for a given CLOSID.<br /> <br /> This support missed that some platforms may not have these counters. This<br /> causes a NULL pointer dereference when creating a new control group as the<br /> array was not allocated by dom_data_init().<br /> <br /> As this feature isn&amp;#39;t necessary on platforms that don&amp;#39;t have cache occupancy<br /> monitors, add this to the check that occurs when a new control group is<br /> allocated.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.9 (including) 6.12.23 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.13.11 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.14 (including) 6.14.2 (excluding)