5.5

CVE-2025-38195: LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()

Modified
AliasesUBUNTU-CVE-2025-38195DEBIAN-CVE-2025-38195
Published 04-07-2025Last modified 30-10-2026

Vulnerability summary

CVE-2025-38195 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.18%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2
MGASA-2025-0218MGASA-2025-0219

Timeline

  1. 04-07-2025
    PublishedVulnerability first disclosed.
  2. 30-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() ERROR INFO: CPU 25 Unable to handle kernel paging request at virtual address 0x0 ... Call Trace: [<900000000023c30c>] huge_pte_offset+0x3c/0x58 [<900000000057fd4c>] hugetlb_follow_page_mask+0x74/0x438 [<900000000051fee8>] __get_user_pages+0xe0/0x4c8 [<9000000000522414>] faultin_page_range+0x84/0x380 [<9000000000564e8c>] madvise_vma_behavior+0x534/0xa48 [<900000000056689c>] do_madvise+0x1bc/0x3e8 [<9000000000566df4>] sys_madvise+0x24/0x38 [<90000000015b9e88>] do_syscall+0x78/0x98 [<9000000000221f18>] handle_syscall+0xb8/0x158 In some cases, pmd may be NULL and rely on NULL as the return value for processing, so it is necessary to determine this situation here.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu81 products
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
  • linux-aws-5.13All versions (No fix recorded)
  • linux-aws-5.19All versions (No fix recorded)
Linux2 products
  • linux≥ 34256805720993e37adf6127371a1265aea8376a, < 55a9a7d21309bbea1dd629cf28396521a2803bb3 | ≥ 2ca9380b12711afe95b3589bd82b59623b3c96b3, < b427d98d55217b53c88643579fbbd8a4c351a105 | ≥ 51424fd171cee6a33f01f7c66b8eb23ac42289d4, < 985f086f281b7bbb6644851e63af1a17ffff9277 | ≥ bd51834d1cf65a2c801295d230c220aeebf87a73, < b5c7397b7fd125203c60b59860c168ee92291272 | ≥ bd51834d1cf65a2c801295d230c220aeebf87a73, < ee084fa96123ede8b0563a1b5a9b23adc43cd50d | b49f085cd671addbda4802d6b9382513f7dd0f30 | ≥ 6.1.136, < 6.1.191 | ≥ 6.6.89, < 6.6.95 | ≥ 6.12.26, < 6.12.35 | ≥ 6.14.5, < 6.15 | 6.15
  • linux_kernelEOL≥ 6.1.136, < 6.2 | ≥ 6.6.89, < 6.6.95 | ≥ 6.12.26, < 6.12.35 | ≥ 6.14.5, < 6.15 | ≥ 6.15.1, < 6.15.4 | 6.15 | 6.15:rc4 | 6.15:rc5 | 6.15:rc6 | 6.15:rc7
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.35-1

3 vendors · 84 products

References

9 links