VDB
CVE-2025-38518
CVE-2025-38518
PUBLISHED
CVSS 5.5 MEDIUM
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Disable INVLPGB on Zen2 AMD Cyan Skillfish (Family 17h, Model 47h, Stepping 0h) has an issue that causes system oopses and panics when performing TLB flush using INVLPGB. However, the problem is that that machine has misconfigured CPUID and should not report the INVLPGB bit in the first place. So zap the kernel's representation of the flag so that nothing gets confused. [ bp: Massage. ]
EPSS 0.03% · 8.3th percentile
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.03%
8.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| linux | linux_kernel | 6.15, 6.16, 6.16 |
| Linux | Linux | 767ae437a32d644786c0779d0d54492ff9cbe574, 6.15, 0 |
Exploit Intelligence
- CIRCL seen: CVE-2025-38518 (circl-sighting)
- https://git.kernel.org/stable/c/357f121517924e3ec3021f9d0dd0189adcd09867 (circl)
- https://git.kernel.org/stable/c/a74bb5f202dabddfea96abc1328fcedae8aa140a (circl)
- CVE-2025-38062.yara (github-yara)
- CVE-2025-38062.yara (github-yara)
- TestCaseRule-CVE-2025-38499.yara (github-yara)
- TestCaseRule-CVE-2025-38499.yara (github-yara)
- TestCaseRule-CVE-2025-38499.yara (github-yara)
- TestCaseRule-CVE-2025-38499.yara (github-yara)
- CVE-2025-38062.yara (github-yara)
…and 8 more exploits
Timeline
- Aug 16, 2025 EPSS Score
- Aug 16, 2025 CVE Published
- Aug 16, 2025 PoC Published
- Aug 24, 2025 EPSS Score
- Sep 1, 2025 EPSS Score
- Sep 10, 2025 EPSS Score
- Sep 18, 2025 EPSS Score
- Sep 26, 2025 EPSS Score
- Oct 4, 2025 EPSS Score
- Oct 12, 2025 EPSS Score
- Oct 12, 2025 PoC Published
- Oct 20, 2025 EPSS Score