Critical Vulnerability in Linux Kernel: Identity Mapping Issue in Lowcore Memory
Summary
DEBIAN-CVE-2025-38733: In the Linux kernel, the following vulnerability has been resolved: s390/mm: Do not map lowcore with identity mapping Since the identity mapping is pinned to address zero the lowcore is always also mapped to address zero... Affects linux versions < 6.12.48-1. Fixed in 6.12.48-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the memory mapping of lowcore, which is crucial for system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the mapping of lowcore memory with identity mapping. This issue arises because the identity mapping is pinned to address zero, causing lowcore to be mapped to address zero as well. When the relocate_lowcore command line option is specified, lowcore is mapped twice instead of once. This flaw allows NULL pointer accesses to succeed, potentially leading to system instability and security breaches, as low address protection only partially mitigates the issue.
How To Fix
Minimum fixed version
6.12.48-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel to the recommended versions.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks due to improper memory mapping, which can lead to system instability and security issues. It is crucial for users to update their systems to the patched versions to mitigate these risks effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper memory mapping in the Linux kernel, allowing NULL pointer accesses to succeed.
Debian 13 and Debian 14 are affected, specifically versions prior to 6.12.48-1 and 6.16.5-1 respectively.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Failure to address this vulnerability may lead to system instability and potential security breaches due to unauthorized access to lowcore memory.
Currently, there are no specific workarounds available. The recommended action is to update to the patched versions as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
