Kernel Vulnerability in Linux for RISC-V Architecture

CVE-2025-38433

What is CVE-2025-38433?

A vulnerability exists in the Linux kernel related to RISC-V architecture, where the __runtime_fixup_32 function fails to manage zero values appropriately. This results in garbage data residing in registers that are intended to store pointers, leading to potential kernel panics when an invalid pointer is accessed. The flaw primarily affects nommu kernels, particularly when dealing with physical addresses below the 4GiB boundary. The root cause lies in the failure to modify the instruction flow adequately based on the required conditions, potentially jeopardizing system stability.

References