CVE-2025-38047 x86/fred: Fix system hang during S4 resume with FRED enabled
A system hang occurs during S4 resume when FRED is enabled, requiring a kernel patch to ensure correct MSR initialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38047?
CVE-2025-38047 is a medium-severity denial of service vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Fix system hang during S4 resume with FRED enabled
Upon a wakeup from S4, the restore kernel starts and initializes the FRED MSRs as needed from its perspective. It then loads a hibernation image, including the image kernel, and attempts to load image pages directly into their original page frames used before hibernation unless those frames are currently in use. Once all pages are moved to their original locations, it jumps to a "trampoline" page in the image kernel.
At this point, the image kernel takes control, but the FRED MSRs still contain values set by the restore kernel, which may differ from those set by the image kernel before hibernation. Therefore, the image kernel must ensure the FRED MSRs have the same values as before hibernation. Since these values depend only on the location of the kernel text and data, they can be recomputed from scratch.
Which versions are affected by CVE-2025-38047?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38047?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38047 being exploited?
There is no known exploitation of CVE-2025-38047 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38047, DEBIAN-CVE-2025-38047, GHSA-75g2-7r3j-m79g, ROOT-OS-DEBIAN-12-CVE-2025-38047, ROOT-OS-UBUNTU-2204-CVE-2025-38047, ROOT-OS-UBUNTU-2404-CVE-2025-38047 and 1 more.