CVE-2025-38257: Linux Kernel Integer Overflow Vulnerability

CVE-2025-38257 Overview

CVE-2025-38257 is an integer overflow vulnerability in the Linux kernel's s390/pkey subsystem. The flaw resides in the size calculation passed to memdup_user() when handling the nr_apqns value supplied from userspace through an ioctl call. Because the multiplication used to compute the buffer size is not overflow-checked, a crafted request can produce a size value that desynchronizes from the actual allocated area. This mismatch leads to unpredictable kernel behavior, including potential memory corruption and local privilege escalation on affected s390 (IBM Z) systems. The issue was reported by the Linux Verification Center (linuxtesting.org) and resolved by switching to the memdup_array_user() helper, which detects overflow and returns an error.

Critical Impact
A local, authenticated user can trigger an integer overflow in the s390/pkey ioctl path, corrupting kernel memory and potentially escalating privileges on affected IBM Z Linux systems.

Affected Products

Linux kernel stable branches prior to the fixed commits, including 6.16-rc1, 6.16-rc2, and 6.16-rc3
Debian Linux 11.0 (Bullseye) kernel packages prior to the LTS security update
s390/s390x builds of the Linux kernel exposing the pkey character device

Discovery Timeline

2025-07-09 - CVE-2025-38257 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38257

Vulnerability Analysis

The vulnerability lives in the s390/pkey kernel component, which exposes cryptographic key management operations for IBM Z hardware through an ioctl interface. Userspace passes a target list of Adjunct Processor Queue Numbers (APQNs) along with the count field nr_apqns. The kernel then computes a byte size by multiplying nr_apqns by the size of each entry before calling memdup_user() to copy the array from userspace. Because nr_apqns is fully attacker-controlled and unbounded, the multiplication can wrap around the size_t type. When wraparound occurs, memdup_user() allocates a small buffer while the code continues to treat it as large, producing an out-of-bounds write during the subsequent copy_from_user() and downstream heap corruption when the array is iterated. The upstream fix replaces the raw call with memdup_array_user(), which performs a checked multiplication and returns -EOVERFLOW on wrap.

Root Cause

The root cause is missing overflow validation on a userspace-supplied length used in kernel memory allocation. The nr_apqns * sizeof(struct apqn) expression is evaluated without size_mul() or an equivalent checked helper, allowing the product to silently truncate. This is a classic size calculation flaw where the allocation size and the loop bound derived from nr_apqns diverge.

Attack Vector

Exploitation requires local access with permission to open the /dev/pkey device and issue the affected ioctl command. An attacker crafts an nr_apqns value large enough that the byte-size product overflows to a small number. The kernel allocates a small buffer, then reads or writes based on the original nr_apqns count, triggering heap-out-of-bounds behavior. On s390x systems where cryptographic hardware is exposed to non-root workloads or containers, this widens the attack surface.

No public proof-of-concept exploit has been published, and CVE-2025-38257 is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-38257

Indicators of Compromise

Unexpected kernel oops, BUG: messages, or KASAN reports referencing pkey_handler, memdup_user, or the s390/pkey module in dmesg and /var/log/kern.log
Processes on s390x hosts opening /dev/pkey that are not part of the expected cryptographic workload inventory
Sudden kernel panics or slab corruption warnings on IBM Z guests following userspace ioctl activity

Detection Strategies

Inventory running kernel versions on s390/s390x hosts and flag any kernel not carrying one of the fix commits (73483ca7, 7360ee47, 88f38696, ad1bdd24, f855b119, faa1ab4a).
Enable CONFIG_KASAN or CONFIG_SLUB_DEBUG on test systems to surface heap corruption originating from the pkey path during fuzzing.
Audit ioctl calls to /dev/pkey via auditd with a rule on the device inode to capture calling PID, UID, and argument counts.

Monitoring Recommendations

Forward kernel ring buffer and audit logs to a centralized analytics platform and alert on kernel crashes correlated with pkey device access.
Track package versions of linux-image-* across the fleet and alert when a mainframe host drifts behind the vendor-patched baseline.
Monitor container and VM workloads on s390x for unexpected access to cryptographic device nodes that should be restricted to specific service accounts.

How to Mitigate CVE-2025-38257

Immediate Actions Required

Apply the latest stable kernel from your distribution vendor that includes the upstream memdup_array_user() fix for s390/pkey.
Debian 11 users should install the kernel update announced in the Debian LTS Announcement.
Restrict access to /dev/pkey to trusted service accounts using file permissions, udev rules, or Linux capabilities.

Patch Information

The fix is present in the upstream Linux stable tree via commits 73483ca7, 7360ee47, 88f38696, ad1bdd24, f855b119, and faa1ab4a. Each backports the swap from memdup_user() to the overflow-checked memdup_array_user() helper in the pkey ioctl handler.

Workarounds

Unload or blacklist the pkey kernel module on s390x systems that do not require CCA, EP11, or protected-key cryptography.
Tighten permissions on /dev/pkey so only privileged, audited processes can issue ioctls to the device.
Isolate untrusted workloads from IBM Z hardware crypto devices using seccomp, SELinux, or AppArmor profiles that deny the affected ioctl commands.

bash

# Example: restrict /dev/pkey to a dedicated group and audit ioctl usage
sudo groupadd pkeyusers
sudo chown root:pkeyusers /dev/pkey
sudo chmod 0660 /dev/pkey

# Persist via udev
cat <<'EOF' | sudo tee /etc/udev/rules.d/60-pkey.rules
KERNEL=="pkey", MODE="0660", GROUP="pkeyusers"
EOF

# Audit ioctl access to the device
sudo auditctl -w /dev/pkey -p rwa -k pkey_ioctl