CVE-2025-38686 is a vulnerability in the Linux kernel's userfaultfd mechanism that can lead to a system crash. Specifically, it occurs when UFFDIO_MOVE encounters a migration PMD entry and attempts to access it incorrectly. This issue has a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity, requiring low privileges, and resulting in high availability impact. There is currently no known active exploitation, public exploit code, or Metasploit/Nuclei modules available, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.8, < 6.12.43CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.13, < 6.15.11CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.16, < 6.16.2CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.17CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Linux kernel (Azure) vulnerabilities
Mar 25, 2026Linux kernel (Azure FIPS) vulnerabilities
Mar 4, 2026Linux kernel (Azure) vulnerabilities
Mar 4, 2026Linux kernel (Xilinx) vulnerabilities
Feb 24, 2026Linux kernel (IBM) vulnerabilities
Feb 24, 2026kernel: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry
Sep 4, 2025