CVE-2025-38466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38466", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.020Z", "datePublished": "2025-07-25T15:27:48.235Z", "dateUpdated": "2026-10-15T21:52:16.799Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:07.957Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Revert to requiring CAP_SYS_ADMIN for uprobes\n\nJann reports that uprobes can be used destructively when used in the\nmiddle of an instruction. The kernel only verifies there is a valid\ninstruction at the requested offset, but due to variable instruction\nlength cannot determine if this is an instruction as seen by the\nintended execution stream.\n\nAdditionally, Mark Rutland notes that on architectures that mix data\nin the text segment (like arm64), a similar things can be done if the\ndata word is 'mistaken' for an instruction.\n\nAs such, require CAP_SYS_ADMIN for uprobes."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attack is performed entirely through the local `perf_event_open(2)` syscall with `attr.type = perf_uprobe.type` and an attacker-supplied `uprobe_path`/`probe_offset`. No network or physical access is involved.\nAC:L - Exploitation is fully deterministic \u2014 the attacker picks the file and the byte offset, and `arch_uprobe_analyze_insn()` accepts essentially any mid-instruction offset since the x86 decoder finds a valid instruction there. There is no race to win and no dependence on memory layout the attacker cannot control.\nPR:L - The pre-fix gate is `perfmon_capable()`, i.e. CAP_PERFMON \u2014 a deliberately non-administrative, \"principle of least privilege\" observability capability routinely delegated to ordinary developers, CI runners, profiling tools (`setcap cap_perfmon+ep /usr/bin/perf`) and monitoring agents precisely so they need not be root. The essence of this flaw is that this basic, non-admin privilege confers system-wide code-modification power, so it is not the \"significant/administrative control\" that PR:H describes.\nUI:N - `register_for_each_vma()` walks the inode's i_mmap tree and patches every mm already mapping the target file, so the attacker can corrupt an already-running root daemon (via `libc.so.6`, `sshd`, `systemd`) immediately. No victim action is required.\nS:U - The vulnerable component and the impacted resources \u2014 other processes' text and data \u2014 are both managed by the same Linux kernel security authority. This is a standard local privilege escalation, not a VM/IOMMU/sandbox boundary crossing.\nC:H - Writing an attacker-chosen `0xCC` mid-instruction lets the attacker neutralize security checks or redirect control flow inside root-owned processes and setuid binaries, and `ref_ctr_offset` supplies an additional arbitrary-offset write into their mappings. This yields code execution as root and hence disclosure of arbitrary system data.\nI:H - The attacker obtains attacker-placed byte corruption at any offset of any executable or shared library system-wide (plus an arbitrary 16-bit write primitive via `__update_ref_ctr()`), with no permission check on the target file. That is direct code-integrity destruction and privilege escalation to root.\nA:H - Corrupting an instruction in a widely mapped library such as `libc.so.6` immediately crashes or wedges every process mapping it, including init/systemd and other critical daemons, resulting in system-wide denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/events/core.c"], "versions": [{"version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "d7ef1afd5b3f43f4924326164cee5397b66abd9c", "status": "affected", "versionType": "git"}, {"version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "c0aec35f861fa746ca45aa816161c74352e6ada8", "status": "affected", "versionType": "git"}, {"version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "8e8bf7bc6aa6f583336c2fda280b6cea0aed5612", "status": "affected", "versionType": "git"}, {"version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "183bdb89af1b5193b1d1d9316986053b15ca6fa4", "status": "affected", "versionType": "git"}, {"version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "a0a8009083e569b5526c64f7d3f2a62baca95164", "status": "affected", "versionType": "git"}, {"version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "d5074256b642cdeb46a70ce2f15193e766edca68", "status": "affected", "versionType": "git"}, {"version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "ba677dbe77af5ffe6204e0f3f547f3ba059c6302", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/events/core.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.240", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.189", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.146", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.99", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.39", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.7", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.240"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.146"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.99"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.15.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d7ef1afd5b3f43f4924326164cee5397b66abd9c"}, {"url": "https://git.kernel.org/stable/c/c0aec35f861fa746ca45aa816161c74352e6ada8"}, {"url": "https://git.kernel.org/stable/c/8e8bf7bc6aa6f583336c2fda280b6cea0aed5612"}, {"url": "https://git.kernel.org/stable/c/183bdb89af1b5193b1d1d9316986053b15ca6fa4"}, {"url": "https://git.kernel.org/stable/c/a0a8009083e569b5526c64f7d3f2a62baca95164"}, {"url": "https://git.kernel.org/stable/c/d5074256b642cdeb46a70ce2f15193e766edca68"}, {"url": "https://git.kernel.org/stable/c/ba677dbe77af5ffe6204e0f3f547f3ba059c6302"}], "title": "perf: Revert to requiring CAP_SYS_ADMIN for uprobes", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:38:29.560Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:07:20.365Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:50:41.107124Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:16.799Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:38:29.560Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:07:20.365Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:50:41.107124Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:50:41.837Z"}}], "cna": {"title": "perf: Revert to requiring CAP_SYS_ADMIN for uprobes", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The attack is performed entirely through the local `perf_event_open(2)` syscall with `attr.type = perf_uprobe.type` and an attacker-supplied `uprobe_path`/`probe_offset`. No network or physical access is involved.\nAC:L - Exploitation is fully deterministic \u2014 the attacker picks the file and the byte offset, and `arch_uprobe_analyze_insn()` accepts essentially any mid-instruction offset since the x86 decoder finds a valid instruction there. There is no race to win and no dependence on memory layout the attacker cannot control.\nPR:L - The pre-fix gate is `perfmon_capable()`, i.e. CAP_PERFMON \u2014 a deliberately non-administrative, \"principle of least privilege\" observability capability routinely delegated to ordinary developers, CI runners, profiling tools (`setcap cap_perfmon+ep /usr/bin/perf`) and monitoring agents precisely so they need not be root. The essence of this flaw is that this basic, non-admin privilege confers system-wide code-modification power, so it is not the \"significant/administrative control\" that PR:H describes.\nUI:N - `register_for_each_vma()` walks the inode's i_mmap tree and patches every mm already mapping the target file, so the attacker can corrupt an already-running root daemon (via `libc.so.6`, `sshd`, `systemd`) immediately. No victim action is required.\nS:U - The vulnerable component and the impacted resources \u2014 other processes' text and data \u2014 are both managed by the same Linux kernel security authority. This is a standard local privilege escalation, not a VM/IOMMU/sandbox boundary crossing.\nC:H - Writing an attacker-chosen `0xCC` mid-instruction lets the attacker neutralize security checks or redirect control flow inside root-owned processes and setuid binaries, and `ref_ctr_offset` supplies an additional arbitrary-offset write into their mappings. This yields code execution as root and hence disclosure of arbitrary system data.\nI:H - The attacker obtains attacker-placed byte corruption at any offset of any executable or shared library system-wide (plus an arbitrary 16-bit write primitive via `__update_ref_ctr()`), with no permission check on the target file. That is direct code-integrity destruction and privilege escalation to root.\nA:H - Corrupting an instruction in a widely mapped library such as `libc.so.6` immediately crashes or wedges every process mapping it, including init/systemd and other critical daemons, resulting in system-wide denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "d7ef1afd5b3f43f4924326164cee5397b66abd9c", "versionType": "git"}, {"status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "c0aec35f861fa746ca45aa816161c74352e6ada8", "versionType": "git"}, {"status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "8e8bf7bc6aa6f583336c2fda280b6cea0aed5612", "versionType": "git"}, {"status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "183bdb89af1b5193b1d1d9316986053b15ca6fa4", "versionType": "git"}, {"status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "a0a8009083e569b5526c64f7d3f2a62baca95164", "versionType": "git"}, {"status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "d5074256b642cdeb46a70ce2f15193e766edca68", "versionType": "git"}, {"status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "lessThan": "ba677dbe77af5ffe6204e0f3f547f3ba059c6302", "versionType": "git"}], "programFiles": ["kernel/events/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.240", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.189", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.146", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.99", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.39", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.7", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/events/core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d7ef1afd5b3f43f4924326164cee5397b66abd9c"}, {"url": "https://git.kernel.org/stable/c/c0aec35f861fa746ca45aa816161c74352e6ada8"}, {"url": "https://git.kernel.org/stable/c/8e8bf7bc6aa6f583336c2fda280b6cea0aed5612"}, {"url": "https://git.kernel.org/stable/c/183bdb89af1b5193b1d1d9316986053b15ca6fa4"}, {"url": "https://git.kernel.org/stable/c/a0a8009083e569b5526c64f7d3f2a62baca95164"}, {"url": "https://git.kernel.org/stable/c/d5074256b642cdeb46a70ce2f15193e766edca68"}, {"url": "https://git.kernel.org/stable/c/ba677dbe77af5ffe6204e0f3f547f3ba059c6302"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Revert to requiring CAP_SYS_ADMIN for uprobes\n\nJann reports that uprobes can be used destructively when used in the\nmiddle of an instruction. The kernel only verifies there is a valid\ninstruction at the requested offset, but due to variable instruction\nlength cannot determine if this is an instruction as seen by the\nintended execution stream.\n\nAdditionally, Mark Rutland notes that on architectures that mix data\nin the text segment (like arm64), a similar things can be done if the\ndata word is 'mistaken' for an instruction.\n\nAs such, require CAP_SYS_ADMIN for uprobes."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.240", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.189", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.146", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.99", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.39", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.7", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "5.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:07.957Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38466", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:16.799Z", "dateReserved": "2025-04-16T04:51:24.020Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-25T15:27:48.235Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/events/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d7ef1afd5b3f43f4924326164cee5397b66abd9c", "status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "versionType": "git"}, {"lessThan": "c0aec35f861fa746ca45aa816161c74352e6ada8", "status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "versionType": "git"}, {"lessThan": "8e8bf7bc6aa6f583336c2fda280b6cea0aed5612", "status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "versionType": "git"}, {"lessThan": "183bdb89af1b5193b1d1d9316986053b15ca6fa4", "status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "versionType": "git"}, {"lessThan": "a0a8009083e569b5526c64f7d3f2a62baca95164", "status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "versionType": "git"}, {"lessThan": "d5074256b642cdeb46a70ce2f15193e766edca68", "status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "versionType": "git"}, {"lessThan": "ba677dbe77af5ffe6204e0f3f547f3ba059c6302", "status": "affected", "version": "c9e0924e5c2b59365f9c0d43ff8722e79ecf4088", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/events/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.240", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.189", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.146", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.99", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.39", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B65172B8-EDE3-4F66-971A-32B42930886F", "versionEndExcluding": "5.10.240", "versionStartIncluding": "5.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3CE0FB9A-DBE8-48B6-BF6E-3C724A4991E3", "versionEndExcluding": "5.15.189", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8DA1166-5C95-475E-BF65-1DF621968E96", "versionEndExcluding": "6.1.146", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B369699C-E0E6-42A4-BDEE-8E676ECEF6AA", "versionEndExcluding": "6.6.99", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "18D57670-11F8-4B5A-AD56-EA32DD0F44E1", "versionEndExcluding": "6.12.39", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F9C46937-5FA9-4335-AD7B-E7FC29453CE1", "versionEndExcluding": "6.15.7", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Revert to requiring CAP_SYS_ADMIN for uprobes\n\nJann reports that uprobes can be used destructively when used in the\nmiddle of an instruction. The kernel only verifies there is a valid\ninstruction at the requested offset, but due to variable instruction\nlength cannot determine if this is an instruction as seen by the\nintended execution stream.\n\nAdditionally, Mark Rutland notes that on architectures that mix data\nin the text segment (like arm64), a similar things can be done if the\ndata word is 'mistaken' for an instruction.\n\nAs such, require CAP_SYS_ADMIN for uprobes."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf: Revertir al requisito de CAP_SYS_ADMIN para uprobes. Jann informa que los uprobes pueden usarse de forma destructiva cuando se usan en medio de una instrucci\u00f3n. El kernel solo verifica que haya una instrucci\u00f3n v\u00e1lida en el desplazamiento solicitado, pero debido a la longitud variable de la instrucci\u00f3n, no puede determinar si se trata de una instrucci\u00f3n como la detecta el flujo de ejecuci\u00f3n previsto. Adem\u00e1s, Mark Rutland se\u00f1ala que en arquitecturas que mezclan datos en el segmento de texto (como arm64), se puede realizar una acci\u00f3n similar si la palabra de datos se confunde con una instrucci\u00f3n. Por lo tanto, se requiere CAP_SYS_ADMIN para uprobes."}], "id": "CVE-2025-38466", "lastModified": "2026-10-15T22:18:42.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38466", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:50:41.107124Z", "version": "2.0.3"}}]}, "published": "2025-07-25T16:15:32.673", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/183bdb89af1b5193b1d1d9316986053b15ca6fa4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e8bf7bc6aa6f583336c2fda280b6cea0aed5612"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a0a8009083e569b5526c64f7d3f2a62baca95164"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ba677dbe77af5ffe6204e0f3f547f3ba059c6302"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c0aec35f861fa746ca45aa816161c74352e6ada8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d5074256b642cdeb46a70ce2f15193e766edca68"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d7ef1afd5b3f43f4924326164cee5397b66abd9c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: perf: Revert to requiring CAP_SYS_ADMIN for uprobes", "id": "2383482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383482"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nperf: Revert to requiring CAP_SYS_ADMIN for uprobes\nJann reports that uprobes can be used destructively when used in the\nmiddle of an instruction. The kernel only verifies there is a valid\ninstruction at the requested offset, but due to variable instruction\nlength cannot determine if this is an instruction as seen by the\nintended execution stream.\nAdditionally, Mark Rutland notes that on architectures that mix data\nin the text segment (like arm64), a similar things can be done if the\ndata word is 'mistaken' for an instruction.\nAs such, require CAP_SYS_ADMIN for uprobes."], "name": "CVE-2025-38466", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38466\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38466\nhttps://lore.kernel.org/linux-cve-announce/2025072508-CVE-2025-38466-11e8@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-26T12:07:37.276318+00:00", "updated": "2025-07-26T12:07:37.276377+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}