{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-38433 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-38433 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-38433 and fix it if it is affected.\n\nWhat it is: CVE-2025-38433 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-38433 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-38433/ (Markdown: https://insights.sbomify.com/CVE-2025-38433/index.md)","id":"CVE-2025-38433","markdown":"https://insights.sbomify.com/CVE-2025-38433/index.md","name":"CVE-2025-38433","record":{"aliases":["BELL-CVE-2025-38433","GHSA-w922-jv62-78r5","UBUNTU-CVE-2025-38433"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A logic error in RISC-V nommu kernel patching causes invalid pointers and kernel panics, requiring a patch to prevent denial of service.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: fix runtime constant support for nommu kernels\n\nthe `__runtime_fixup_32` function does not handle the case where `val` is\nzero correctly (as might occur when patching a nommu kernel and referring\nto a physical address below the 4GiB boundary whose upper 32 bits are all\nzero) because nothing in the existing logic prevents the code from taking\nthe `else` branch of both nop-checks and emitting two `nop` instructions.\n\nThis leaves random garbage in the register that is supposed to receive the\nupper 32 bits of the pointer instead of zero that when combined with the\nvalue for the lower 32 bits yields an invalid pointer and causes a kernel\npanic when that pointer is eventually accessed.\n\nThe author clearly considered the fact that if the `lui` is converted into\na `nop` that the second instruction needs to be adjusted to become an `li`\ninstead of an `addi`, hence introducing the `addi_insn_mask` variable, but\ndidn't follow that logic through fully to the case where the `else` branch\nexecutes. To fix it just adjust the logic to ensure that the second `else`\nbranch is not taken if the first instruction will be patched to a `nop`.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"riscv: fix runtime constant support for nommu kernels","id":"CVE-2025-38433","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"Revert \"riscv: Define TASK_SIZE_MAX for __access_ok()\"","id":"CVE-2025-38434"},"packages":[],"prev":{"headline":"net: netpoll: Initialize UDP checksum field before checksumming","id":"CVE-2025-38432"},"products":["Linux"],"published":"2025-07-25","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A logic error in RISC-V nommu kernel patching causes invalid pointers and kernel panics, requiring a patch to prevent denial of service.","url":"https://insights.sbomify.com/CVE-2025-38433/"}