CVE-2025-38298: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38298 Overview

CVE-2025-38298 is a Linux kernel vulnerability in the Error Detection and Correction (EDAC) subsystem, specifically within the skx_common module shared by i10nm_edac and skx_edac drivers. The flaw causes a general protection fault due to improper reset of the adxl_component_count variable during module unload and reload cycles. When i10nm_edac is unloaded and reloaded, the ADXL component counter doubles, producing an out-of-bounds access to the ADXL component array during machine check event decoding. The vulnerability is classified as an out-of-bounds write [CWE-787] affecting Intel server platforms using Address Decoder Library (ADXL) memory error decoding.

Critical Impact
Local attackers with module load privileges can trigger a kernel general protection fault, causing denial of service and potential memory corruption on affected Intel-based Linux servers.

Affected Products

Linux Kernel (multiple stable branches prior to patched commits)
Debian Linux 11 (Bullseye)
Systems using i10nm_edac or skx_edac drivers on Intel Xeon platforms

Discovery Timeline

2025-07-10 - CVE-2025-38298 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38298

Vulnerability Analysis

The defect resides in the skx_edac_common module, which provides shared EDAC functionality for Intel Skylake-era and newer server chipsets. The module maintains a global adxl_component_count variable tracking Address Decoder Library components used for translating machine check error addresses into DIMM locations. When i10nm_edac loads, it automatically pulls in skx_edac_common and increments adxl_component_count to the actual component count. Unloading only i10nm_edac leaves skx_edac_common resident with the counter still populated. Reloading i10nm_edac then increments the counter again, doubling its value.

The inflated counter causes skx_adxl_decode() to index beyond the bounds of the ADXL component array when processing subsequent machine check events. The out-of-bounds read feeds garbage pointers into vsnprintf() via snprintf(), producing the observed general protection fault in string+0x53/0xe0 during workqueue processing of mce_gen_pool_process.

Root Cause

The root cause is missing state cleanup in adxl_put(). The function is invoked when EDAC modules unload but did not reset adxl_component_count to zero. Because the counter lives in skx_edac_common while the initialization logic lives in i10nm_edac and skx_edac, the shared module retained stale state across driver lifecycle transitions.

Attack Vector

Exploitation requires local access with privileges to load or unload kernel modules, typically CAP_SYS_MODULE. An attacker or a system administrator performing routine driver maintenance can trigger the fault by unloading and reloading i10nm_edac on a system that subsequently logs a hardware machine check event. The resulting general protection fault occurs in kernel workqueue context and may crash the kernel worker thread processing MCE events, degrading hardware error reporting reliability. The vulnerability does not require crafted user input beyond the module reload sequence.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream kernel commits linked in the References section.

Detection Methods for CVE-2025-38298

Indicators of Compromise

Kernel Oops: general protection fault messages referencing skx_adxl_decode or skx_mce_check_error in dmesg or /var/log/kern.log.
Call traces containing string+0x53/0xe0 followed by vsnprintf and snprintf under the mce_gen_pool_process workqueue.
Repeated crashes of the kernel MCE processing workqueue after i10nm_edac module reload events.

Detection Strategies

Audit kernel logs for module load and unload events involving i10nm_edac, skx_edac, and skx_edac_common using modprobe and rmmod telemetry.
Compare running kernel versions against the fixed commits (20d2d47, 31ef6f7, 3f5d065, 80bf28f, a13e834, a6ed3a6, bf6a850, e8530ed) using uname -r and distribution package inventories.
Monitor EDAC subsystem status via /sys/devices/system/edac/mc/ and journalctl -k for anomalous decoder errors.

Monitoring Recommendations

Enable persistent kernel crash dump collection with kdump to capture full stack traces of any GPF originating in EDAC modules.
Alert on unexpected modprobe or rmmod activity targeting EDAC drivers on production hardware, particularly outside change windows.
Track machine check event volume alongside module lifecycle events to correlate hardware error reporting failures with driver reloads.

How to Mitigate CVE-2025-38298

Immediate Actions Required

Apply the stable kernel updates containing the fix to adxl_put() that resets adxl_component_count on module unload.
On Debian systems, install the kernel updates referenced in the Debian LTS announcements from October 2025.
Restrict CAP_SYS_MODULE and root access on servers using Intel EDAC drivers to limit who can trigger the reload sequence.

Patch Information

The fix resets adxl_component_count inside adxl_put(), which is called during unload of both skx_edac and i10nm_edac. Patched commits are available across multiple stable branches: Kernel Commit 20d2d47, Kernel Commit 31ef6f7, Kernel Commit 3f5d065, Kernel Commit 80bf28f, Kernel Commit a13e834, Kernel Commit a6ed3a6, Kernel Commit bf6a850, and Kernel Commit e8530ed. Distribution guidance is provided in Debian LTS Announcement #00007 and Debian LTS Announcement #00008.

Workarounds

Avoid unloading and reloading i10nm_edac on production systems until the patched kernel is deployed; reboot the system instead of hot-reloading EDAC drivers.
Blocklist manual driver reloads in operational runbooks and configuration management to prevent inadvertent triggering during maintenance.
If EDAC reporting is not required, consider blacklisting i10nm_edac via /etc/modprobe.d/ on unaffected workloads, accepting the loss of DIMM-level MCE decoding.