Kernel Panic Vulnerability in Linux Package: CVE-2025-38033
Summary
DEBIAN-CVE-2025-38033: In the Linux kernel, the following vulnerability has been resolved: x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST or Rust >= 1.88 Calling core::fmt::write() from rust code while FineIBT is enabled results in a kerne... Affects linux versions < 6.12.32-1. Fixed in 6.12.32-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used across various distributions and is known for its stability and performance. However, it is also susceptible to vulnerabilities that can compromise system integrity and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified that affects the interaction between Rust code and the FineIBT feature. Specifically, calling core::fmt::write() from Rust code while FineIBT is enabled can lead to a kernel panic. This occurs due to a Control Protection exception caused by the FineIBT sealing off the original function's endbr64, making Rust incompatible with FineIBT. The vulnerability is rooted in the configuration of the kernel and the Rust programming language's integration, which has not yet fully addressed this issue.
How To Fix
Minimum fixed version
6.12.32-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the FineIBT feature in the kernel configuration if Rust is being used. This can be done by modifying the kernel configuration file and ensuring that FineIBT is not enabled.
Conclusion
The CVE-2025-38033 vulnerability in the Linux kernel poses a significant risk for systems utilizing Rust code with FineIBT enabled. Users are advised to update to the latest patched version to ensure system stability and security. For those unable to update immediately, disabling FineIBT can serve as a temporary measure.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38033 is a vulnerability in the Linux kernel that can cause a kernel panic when Rust code interacts with the FineIBT feature.
If your system uses Rust code with FineIBT enabled, it may experience crashes or instability due to this vulnerability.
Yes, a patch is available in version 6.12.32-1 of the Linux package. Users should update to this version to mitigate the risk.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software without requiring code access. Visit Vulert Scanner to check your application.
If an immediate update is not possible, consider disabling the FineIBT feature as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
