# CVE-2025-38334: x86/sgx: Prevent attempts to reclaim poisoned pages > Attackers can trigger a kernel panic by forcing the reclamation of poisoned SGX pages, causing a denial of service on Linux systems. - **Severity:** Medium 5.5 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 10 Jul 2025 - **Updated:** 11 May 2026 - **Also known as:** AZL-65009, AZL-72587, BELL-CVE-2025-38334, DEBIAN-CVE-2025-38334, GHSA-chrh-m3h6-4898, ROOT-OS-DEBIAN-12-CVE-2025-38334, ROOT-OS-UBUNTU-2204-CVE-2025-38334, ROOT-OS-UBUNTU-2404-CVE-2025-38334, UBUNTU-CVE-2025-38334 ## What is CVE-2025-38334? CVE-2025-38334 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 10 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Prevent attempts to reclaim poisoned pages TL;DR: SGX page reclaim touches the page to copy its contents to secondary storage. SGX instructions do not gracefully handle machine checks. Despite this, the existing SGX code will try to reclaim pages that it _knows_ are poisoned. Avoid even trying to reclaim poisoned pages. The longer story: Pages used by an enclave only get epc_page->poison set in arch_memory_failure() but they currently stay on sgx_active_page_list until sgx_encl_release(), with the SGX_EPC_PAGE_RECLAIMER_TRACKED flag untouched. epc_page->poison is not checked in the reclaimer logic meaning that, if other conditions are met, an attempt will be made to reclaim an EPC page that was poisoned. This is bad because 1. we don't want that page to end up added to another enclave and 2. it is likely to cause one core to shut down and the kernel to panic. Specifically, reclaiming uses microcode operations including "EWB" which accesses the EPC page contents to encrypt and write them out to non-SGX memory. Those operations cannot handle MCEs in their accesses other than by putting the executing core into a special shutdown state (affecting both threads with HT.) The kernel will subsequently panic on the remaining cores seeing the core didn't enter MCE handler(s) in time. Call sgx_unmark_page_reclaimable() to remove the affected EPC page from sgx_active_page_list on memory error to stop it being considered for reclaiming. Testing epc_page->poison in sgx_reclaim_pages() would also work but I assume it's better to add code in the less likely paths. The affected EPC page is not added to &node->sgx_poison_page_list until later in sgx_encl_release()->sgx_free_epc_page() when it is EREMOVEd. Membership on other lists doesn't change to avoid changing any of the lists' semantics except for sgx_active_page_list. There's a "TBD" comment in arch_memory_failure() about pre-emptive actions, the goal here is not to address everything that it may imply. This also doesn't completely close the time window when a memory error notification will be fatal (for a not previously poisoned EPC page) -- the MCE can happen after sgx_reclaim_pages() has selected its candidates or even *inside* a microcode operation (actually easy to trigger due to the amount of time spent in them.) The spinlock in sgx_unmark_page_reclaimable() is safe because memory_failure() runs in process context and no spinlocks are held, explicitly noted in a mm/memory-failure.c comment. Weakness: CWE-754 (Improper Check for Unusual or Exceptional Conditions) ## Which versions are affected by CVE-2025-38334? It affects 2 products. Products: Debian Debian Linux, Linux kernel. ## How do I fix CVE-2025-38334? Apply the vendor's patch. ## Is CVE-2025-38334 being exploited? There is no known exploitation of CVE-2025-38334 in the wild and no public exploit code. ## Other vulnerabilities in Debian Debian Linux - [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild) - [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild) - [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild) - [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild) - [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2025-38334 and fix it if it is affected. What it is: CVE-2025-38334 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 10 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2025-38334 in the wild and no public exploit code. Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2025-38334/ (Markdown: https://insights.sbomify.com/CVE-2025-38334/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-38334 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-38334 - OSV: https://osv.dev/vulnerability/CVE-2025-38334 --- From sbomify Insights: https://insights.sbomify.com/CVE-2025-38334/ Summaries are generated and may contain mistakes; the official description above is the record.