CVE-2025-38359 (GCVE-0-2025-38359)
Vulnerability from cvelistv5
Published
2025-07-25 12:47
Modified
2025-07-28 04:19
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix in_atomic() handling in do_secure_storage_access() Kernel user spaces accesses to not exported pages in atomic context incorrectly try to resolve the page fault. With debug options enabled call traces like this can be seen: BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [<00000383ea47cfa2>] copy_page_from_iter_atomic+0xa2/0x8a0 CPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39 Tainted: G W 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT Tainted: [W]=WARN Hardware name: IBM 3931 A01 703 (LPAR) Call Trace: [<00000383e990d282>] dump_stack_lvl+0xa2/0xe8 [<00000383e99bf152>] __might_resched+0x292/0x2d0 [<00000383eaa7c374>] down_read+0x34/0x2d0 [<00000383e99432f8>] do_secure_storage_access+0x108/0x360 [<00000383eaa724b0>] __do_pgm_check+0x130/0x220 [<00000383eaa842e4>] pgm_check_handler+0x114/0x160 [<00000383ea47d028>] copy_page_from_iter_atomic+0x128/0x8a0 ([<00000383ea47d016>] copy_page_from_iter_atomic+0x116/0x8a0) [<00000383e9c45eae>] generic_perform_write+0x16e/0x310 [<00000383e9eb87f4>] ext4_buffered_write_iter+0x84/0x160 [<00000383e9da0de4>] vfs_write+0x1c4/0x460 [<00000383e9da123c>] ksys_write+0x7c/0x100 [<00000383eaa7284e>] __do_syscall+0x15e/0x280 [<00000383eaa8417e>] system_call+0x6e/0x90 INFO: lockdep is turned off. It is not allowed to take the mmap_lock while in atomic context. Therefore handle such a secure storage access fault as if the accessed page is not mapped: the uaccess function will return -EFAULT, and the caller has to deal with this. Usually this means that the access is retried in process context, which allows to resolve the page fault (or in this case export the page).
References
Impacted products
Vendor Product Version
Linux Linux Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/mm/fault.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d2e317dfd2d1fe416c77315d17c5d57dbe374915",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "11709abccf93b08adde95ef313c300b0d4bc28f1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/mm/fault.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Fix in_atomic() handling in do_secure_storage_access()\n\nKernel user spaces accesses to not exported pages in atomic context\nincorrectly try to resolve the page fault.\nWith debug options enabled call traces like this can be seen:\n\nBUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39\npreempt_count: 1, expected: 0\nRCU nest depth: 0, expected: 0\nINFO: lockdep is turned off.\nPreemption disabled at:\n[\u003c00000383ea47cfa2\u003e] copy_page_from_iter_atomic+0xa2/0x8a0\nCPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39\nTainted: G        W           6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT\nTainted: [W]=WARN\nHardware name: IBM 3931 A01 703 (LPAR)\nCall Trace:\n [\u003c00000383e990d282\u003e] dump_stack_lvl+0xa2/0xe8\n [\u003c00000383e99bf152\u003e] __might_resched+0x292/0x2d0\n [\u003c00000383eaa7c374\u003e] down_read+0x34/0x2d0\n [\u003c00000383e99432f8\u003e] do_secure_storage_access+0x108/0x360\n [\u003c00000383eaa724b0\u003e] __do_pgm_check+0x130/0x220\n [\u003c00000383eaa842e4\u003e] pgm_check_handler+0x114/0x160\n [\u003c00000383ea47d028\u003e] copy_page_from_iter_atomic+0x128/0x8a0\n([\u003c00000383ea47d016\u003e] copy_page_from_iter_atomic+0x116/0x8a0)\n [\u003c00000383e9c45eae\u003e] generic_perform_write+0x16e/0x310\n [\u003c00000383e9eb87f4\u003e] ext4_buffered_write_iter+0x84/0x160\n [\u003c00000383e9da0de4\u003e] vfs_write+0x1c4/0x460\n [\u003c00000383e9da123c\u003e] ksys_write+0x7c/0x100\n [\u003c00000383eaa7284e\u003e] __do_syscall+0x15e/0x280\n [\u003c00000383eaa8417e\u003e] system_call+0x6e/0x90\nINFO: lockdep is turned off.\n\nIt is not allowed to take the mmap_lock while in atomic context. Therefore\nhandle such a secure storage access fault as if the accessed page is not\nmapped: the uaccess function will return -EFAULT, and the caller has to\ndeal with this. Usually this means that the access is retried in process\ncontext, which allows to resolve the page fault (or in this case export the\npage)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:19:52.197Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d2e317dfd2d1fe416c77315d17c5d57dbe374915"
        },
        {
          "url": "https://git.kernel.org/stable/c/11709abccf93b08adde95ef313c300b0d4bc28f1"
        }
      ],
      "title": "s390/mm: Fix in_atomic() handling in do_secure_storage_access()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38359",
    "datePublished": "2025-07-25T12:47:30.441Z",
    "dateReserved": "2025-04-16T04:51:24.007Z",
    "dateUpdated": "2025-07-28T04:19:52.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38359\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:24.687\",\"lastModified\":\"2025-07-25T15:29:19.837\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/mm: Fix in_atomic() handling in do_secure_storage_access()\\n\\nKernel user spaces accesses to not exported pages in atomic context\\nincorrectly try to resolve the page fault.\\nWith debug options enabled call traces like this can be seen:\\n\\nBUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523\\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39\\npreempt_count: 1, expected: 0\\nRCU nest depth: 0, expected: 0\\nINFO: lockdep is turned off.\\nPreemption disabled at:\\n[\u003c00000383ea47cfa2\u003e] copy_page_from_iter_atomic+0xa2/0x8a0\\nCPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39\\nTainted: G        W           6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT\\nTainted: [W]=WARN\\nHardware name: IBM 3931 A01 703 (LPAR)\\nCall Trace:\\n [\u003c00000383e990d282\u003e] dump_stack_lvl+0xa2/0xe8\\n [\u003c00000383e99bf152\u003e] __might_resched+0x292/0x2d0\\n [\u003c00000383eaa7c374\u003e] down_read+0x34/0x2d0\\n [\u003c00000383e99432f8\u003e] do_secure_storage_access+0x108/0x360\\n [\u003c00000383eaa724b0\u003e] __do_pgm_check+0x130/0x220\\n [\u003c00000383eaa842e4\u003e] pgm_check_handler+0x114/0x160\\n [\u003c00000383ea47d028\u003e] copy_page_from_iter_atomic+0x128/0x8a0\\n([\u003c00000383ea47d016\u003e] copy_page_from_iter_atomic+0x116/0x8a0)\\n [\u003c00000383e9c45eae\u003e] generic_perform_write+0x16e/0x310\\n [\u003c00000383e9eb87f4\u003e] ext4_buffered_write_iter+0x84/0x160\\n [\u003c00000383e9da0de4\u003e] vfs_write+0x1c4/0x460\\n [\u003c00000383e9da123c\u003e] ksys_write+0x7c/0x100\\n [\u003c00000383eaa7284e\u003e] __do_syscall+0x15e/0x280\\n [\u003c00000383eaa8417e\u003e] system_call+0x6e/0x90\\nINFO: lockdep is turned off.\\n\\nIt is not allowed to take the mmap_lock while in atomic context. Therefore\\nhandle such a secure storage access fault as if the accessed page is not\\nmapped: the uaccess function will return -EFAULT, and the caller has to\\ndeal with this. Usually this means that the access is retried in process\\ncontext, which allows to resolve the page fault (or in this case export the\\npage).\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: s390/mm: Se corrige la gesti\u00f3n de in_atomic() en do_secure_storage_access(). Los accesos a espacios de usuario del kernel a p\u00e1ginas no exportadas en contexto at\u00f3mico intentan resolver incorrectamente el fallo de p\u00e1gina. Con las opciones de depuraci\u00f3n habilitadas, se pueden observar seguimientos de llamadas como este: BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. Preemption disabled at: [\u0026lt;00000383ea47cfa2\u0026gt;] copy_page_from_iter_atomic+0xa2/0x8a0 CPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39 Tainted: G W 6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT Tainted: [W]=WARN Hardware name: IBM 3931 A01 703 (LPAR) Call Trace: [\u0026lt;00000383e990d282\u0026gt;] dump_stack_lvl+0xa2/0xe8 [\u0026lt;00000383e99bf152\u0026gt;] __might_resched+0x292/0x2d0 [\u0026lt;00000383eaa7c374\u0026gt;] down_read+0x34/0x2d0 [\u0026lt;00000383e99432f8\u0026gt;] do_secure_storage_access+0x108/0x360 [\u0026lt;00000383eaa724b0\u0026gt;] __do_pgm_check+0x130/0x220 [\u0026lt;00000383eaa842e4\u0026gt;] pgm_check_handler+0x114/0x160 [\u0026lt;00000383ea47d028\u0026gt;] copy_page_from_iter_atomic+0x128/0x8a0 ([\u0026lt;00000383ea47d016\u0026gt;] copy_page_from_iter_atomic+0x116/0x8a0) [\u0026lt;00000383e9c45eae\u0026gt;] generic_perform_write+0x16e/0x310 [\u0026lt;00000383e9eb87f4\u0026gt;] ext4_buffered_write_iter+0x84/0x160 [\u0026lt;00000383e9da0de4\u0026gt;] vfs_write+0x1c4/0x460 [\u0026lt;00000383e9da123c\u0026gt;] ksys_write+0x7c/0x100 [\u0026lt;00000383eaa7284e\u0026gt;] __do_syscall+0x15e/0x280 [\u0026lt;00000383eaa8417e\u0026gt;] system_call+0x6e/0x90 INFO: lockdep is turned off. No se permite usar mmap_lock en contexto at\u00f3mico. Por lo tanto, se gestiona un fallo de acceso al almacenamiento seguro como si la p\u00e1gina accedida no estuviera mapeada: la funci\u00f3n uaccess devolver\u00e1 -EFAULT, y el usuario que realiza la llamada debe gestionarlo. Normalmente, esto significa que se reintenta el acceso en contexto de proceso, lo que permite resolver el fallo de p\u00e1gina (o, en este caso, exportar la p\u00e1gina).\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11709abccf93b08adde95ef313c300b0d4bc28f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d2e317dfd2d1fe416c77315d17c5d57dbe374915\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.