High 7.8Published Jul 25, 2025

CVE-2025-38408genirq/irq_sim: Initialize work context pointers properly

Updated under an hour ago (Oct 27, 2026, 10:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: genirq/irq_sim: Initialize work context pointers properly Initialize `ops` member's pointers properly by using kzalloc() instead of kmalloc() when allocating the simulation work context. Otherwise the pointers contain random content leading to invalid dereferencing.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1 builds before 186df821de0f34490ed5fc0861243748b2483861; from 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1 before c71aa4bb528ae6f8fd7577a0a39e5a03c60b04fb; from 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1 before ec3656a8cb428d763def32bc2fa695f94be23629; 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1 builds before 19bd7597858dd15802c1d99fcc38e528f469080a; 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1 builds before 7f73d1def72532bac4d55ea8838f457a6bed955c; 337cbeb2c13eb4cab84f576fd402d7ae4ed31ae1 builds before 8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819	CNA record
linux linux_kernel linux:linux_kernel	from 5.8 before 6.12.37; from 6.13 before 6.15.6; 6.16; 6.16	NVD

References

References

https://git.kernel.org/stable/c/186df821de0f34490ed5fc0861243748b2483861	patch
https://git.kernel.org/stable/c/c71aa4bb528ae6f8fd7577a0a39e5a03c60b04fb	patch
https://git.kernel.org/stable/c/ec3656a8cb428d763def32bc2fa695f94be23629	patch
https://git.kernel.org/stable/c/19bd7597858dd15802c1d99fcc38e528f469080a	patch
https://git.kernel.org/stable/c/7f73d1def72532bac4d55ea8838f457a6bed955c	patch
https://git.kernel.org/stable/c/8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.