CVE-2025-38733 s390/mm: Do not map lowcore with identity mapping
A Linux kernel flaw allows NULL pointer accesses to succeed on s390 systems, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38733?
CVE-2025-38733 is a high-severity vulnerability in Linux kernel, published on 5 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/mm: Do not map lowcore with identity mapping
Since the identity mapping is pinned to address zero the lowcore is always also mapped to address zero, this happens regardless of the relocate_lowcore command line option. If the option is specified the lowcore is mapped twice, instead of only once.
This means that NULL pointer accesses will succeed instead of causing an exception (low address protection still applies, but covers only parts). To fix this never map the first two pages of physical memory with the identity mapping.
Weakness: CWE-476
Which versions are affected by CVE-2025-38733?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38733?
Apply the vendor's patch.
Is CVE-2025-38733 being exploited?
There is no known exploitation of CVE-2025-38733 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38733, DEBIAN-CVE-2025-38733, GHSA-9w66-p46h-j52f, UBUNTU-CVE-2025-38733.