Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2025-38334: Linux kernel SGX page reclamation can cause system crash
CVE-2025-38334 · published 1 year ago
Summary
The Linux kernel’s support for Intel SGX can try to reuse memory pages that have been marked as faulty. Doing so may trigger a processor error that crashes the system and forces a reboot. Apply the latest kernel updates from your Linux distribution to prevent this behavior.
What to do
- Update canonical linux-azure to version 6.8.0-1046.52.
- Update canonical linux-azure-6.14 to version 6.14.0-1014.14~24.04.1.
- Update canonical linux-azure-nvidia-6.14 to version 6.14.0-1007.7.
- Update canonical rootio-linux to version 6.8.0-110.110.root.io.63.
- Update canonical rootio-linux to version 6.8.0-117.117.root.io.67.
- Update canonical linux-azure-6.8 to version 6.8.0-1051.57~22.04.1.
- Update canonical linux-nvidia-tegra to version 6.8.0-1020.20.
- Update canonical linux-aws-6.8 to version 6.8.0-1046.49~22.04.1.
- Update canonical linux-gcp-6.8 to version 6.8.0-1047.50~22.04.2.
- Update canonical linux-hwe-6.8 to version 6.8.0-100.100~22.04.1.
- Update canonical linux-ibm-6.8 to version 6.8.0-1044.44~22.04.1.
- Update canonical linux-lowlatency-hwe-6.8 to version 6.8.0-100.100.1~22.04.1.
- Update canonical linux-nvidia-6.8 to version 6.8.0-1046.49~22.04.1.
- Update canonical linux-oracle-6.8 to version 6.8.0-1043.44~22.04.1.
- Update canonical linux-riscv-6.8 to version 6.8.0-100.100~22.04.1.
- Update canonical linux-realtime-6.8 to version 6.8.1-1041.42~22.04.1.
- Update canonical linux to version 6.8.0-100.100.
- Update canonical linux-aws to version 6.8.0-1046.49.
- Update canonical linux-aws-6.14 to version 6.14.0-1015.15~24.04.1.
- Update canonical linux-gcp to version 6.8.0-1047.50.
- Update canonical linux-gcp-6.14 to version 6.14.0-1018.19~24.04.1.
- Update canonical linux-gke to version 6.8.0-1043.48.
- Update canonical linux-gkeop to version 6.8.0-1030.33.
- Update canonical linux-ibm to version 6.8.0-1044.44.
- Update canonical linux-lowlatency to version 6.8.0-100.100.1.
- Update canonical linux-nvidia to version 6.8.0-1046.49.
- Update canonical linux-nvidia-lowlatency to version 6.8.0-1046.49.1.
- Update canonical linux-oem-6.14 to version 6.14.0-1014.14.
- Update canonical linux-oracle to version 6.8.0-1043.44.
- Update canonical linux-oracle-6.14 to version 6.14.0-1015.15~24.04.1.
- Update canonical linux-raspi to version 6.8.0-1047.51.
- Update canonical linux-riscv-6.14 to version 6.14.0-34.34.1~24.04.1.
- Update canonical linux-xilinx to version 6.8.0-1023.24.
- Update canonical linux-aws-fips to version 6.8.0-1046.49+fips1.
- Update canonical linux-azure-fips to version 6.8.0-1046.52+fips1.
- Update canonical linux-fips to version 6.8.0-100.100+fips1.
- Update canonical linux-gcp-fips to version 6.8.0-1047.50+fips1.
- Update canonical linux-raspi-realtime to version 6.8.0-2037.38.
- Update canonical linux-realtime to version 6.8.1-1041.42.
- Update canonical linux-realtime-6.14 to version 6.14.0-1014.14~24.04.1.
- Update debian rootio-linux to version 6.1.164-1.root.io.108.
- Update canonical linux to version 5.15.0-187.197.aikido.112.
- Update canonical rootio-linux to version 5.15.0-187.197.aikido.112.
- Update canonical rootio-linux to version 6.8.0-111.111.root.io.65.
- Update canonical rootio-linux to version 6.8.0-111.111.root.io.66.
- Update canonical rootio-linux to version 6.8.0-117.117.root.io.68.
- Update canonical rootio-linux to version 6.8.0-124.124.root.io.70.
- Update canonical rootio-linux to version 6.8.0-124.124.root.io.71.
- Update canonical rootio-linux to version 6.8.0-124.124.root.io.73.
- Update canonical rootio-linux to version 6.8.0-134.134.root.io.79.
- Update canonical rootio-linux to version 6.8.0-134.134.root.io.80.
- Update canonical rootio-linux to version 6.8.0-136.136.root.io.82.
- Update canonical rootio-linux to version 6.8.0-136.136.root.io.83.
- Update canonical linux-bluefield to version 6.8.0-1016.20.
- Update linux to version 6.8.0-146.146.aikido.89.
- Update rootio-linux to version 6.8.0-146.146.aikido.89.
- Update linux to version 5.15.0-198.208.aikido.116.
- Update rootio-linux to version 5.15.0-198.208.aikido.116.
- Update canonical linux-azure-fde-6.8 to version 6.8.0-1046.53~22.04.1.
- Update canonical linux-azure-fde to version 6.8.0-1046.53.
- Update linux to version 6.8.0-147.147.aikido.90.
- Update rootio-linux to version 6.8.0-147.147.aikido.90.
- Update linux kernel to version 6.15.4.
- Update linux to version 6.1.190-1.aikido.167.
- Update rootio-linux to version 6.1.190-1.aikido.167.
- Update linux to version 5.15.0-202.212.aikido.118.
- Update rootio-linux to version 5.15.0-202.212.aikido.118.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 5.11, < 6.1.142 >= 6.2, < 6.6.95 >= 6.7, < 6.12.35 >= 6.13, < 6.15.4 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
11.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | linux-lts-xenial | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-aws-hwe | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:Pro:FIPS:16.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-aws-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-azure-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure |
< 6.8.0-1046.52 Fix: upgrade to 6.8.0-1046.52
|
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.14 |
< 6.14.0-1014.14~24.04.1 Fix: upgrade to 6.14.0-1014.14~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure-fde |
< 6.8.0-1046.53 Fix: upgrade to 6.8.0-1046.53
|
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia-6.14 |
< 6.14.0-1007.7 Fix: upgrade to 6.14.0-1007.7
|
| Root:Ubuntu:24.04 | canonical | rootio-linux |
< 6.8.0-110.110.root.io.63 < 6.8.0-117.117.root.io.67 < 6.8.0-111.111.root.io.65 < 6.8.0-111.111.root.io.66 < 6.8.0-117.117.root.io.68 < 6.8.0-124.124.root.io.70 < 6.8.0-124.124.root.io.71 < 6.8.0-124.124.root.io.73 < 6.8.0-134.134.root.io.79 < 6.8.0-134.134.root.io.80 < 6.8.0-136.136.root.io.82 < 6.8.0-136.136.root.io.83 Fix: upgrade to 6.8.0-110.110.root.io.63
|
| Ubuntu:22.04:LTS | canonical | linux-azure-6.8 |
< 6.8.0-1051.57~22.04.1 Fix: upgrade to 6.8.0-1051.57~22.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-tegra |
< 6.8.0-1020.20 Fix: upgrade to 6.8.0-1020.20
|
| Ubuntu:Pro:18.04:LTS | canonical | linux-azure-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-gcp-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-gcp-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-hwe-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-ibm-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-oracle | All versions |
Showing 50 of 238. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-oracle-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-raspi-5.4 | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-aws-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-fde-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-gcp-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-hwe-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-intel-iotg-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-iot | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-nvidia-tegra-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-oracle-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-raspi | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-riscv-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-xilinx-zynqmp | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:22.04:LTS | canonical | linux | All versions |
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.8 |
< 6.8.0-1046.49~22.04.1 Fix: upgrade to 6.8.0-1046.49~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.8 |
< 6.8.0-1046.53~22.04.1 Fix: upgrade to 6.8.0-1046.53~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.8 |
< 6.8.0-1047.50~22.04.2 Fix: upgrade to 6.8.0-1047.50~22.04.2
|
| Ubuntu:22.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.8 |
< 6.8.0-100.100~22.04.1 Fix: upgrade to 6.8.0-100.100~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-ibm | All versions |
| Ubuntu:22.04:LTS | canonical | linux-ibm-6.8 |
< 6.8.0-1044.44~22.04.1 Fix: upgrade to 6.8.0-1044.44~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg | All versions |
| Ubuntu:22.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.8 |
< 6.8.0-100.100.1~22.04.1 Fix: upgrade to 6.8.0-100.100.1~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.8 |
< 6.8.0-1046.49~22.04.1 Fix: upgrade to 6.8.0-1046.49~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra-igx | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.8 |
< 6.8.0-1043.44~22.04.1 Fix: upgrade to 6.8.0-1043.44~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-raspi | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.8 |
< 6.8.0-100.100~22.04.1 Fix: upgrade to 6.8.0-100.100~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-xilinx-zynqmp | All versions |
| Ubuntu:Nvidia-BlueField:22.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime-6.8 |
< 6.8.1-1041.42~22.04.1 Fix: upgrade to 6.8.1-1041.42~22.04.1
|
| Ubuntu:24.04:LTS | canonical | linux |
< 6.8.0-100.100 Fix: upgrade to 6.8.0-100.100
|
| Ubuntu:24.04:LTS | canonical | linux-aws |
< 6.8.0-1046.49 Fix: upgrade to 6.8.0-1046.49
|
| Ubuntu:24.04:LTS | canonical | linux-aws-6.14 |
< 6.14.0-1015.15~24.04.1 Fix: upgrade to 6.14.0-1015.15~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-gcp |
< 6.8.0-1047.50 Fix: upgrade to 6.8.0-1047.50
|
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.14 |
< 6.14.0-1018.19~24.04.1 Fix: upgrade to 6.14.0-1018.19~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-gke |
< 6.8.0-1043.48 Fix: upgrade to 6.8.0-1043.48
|
| Ubuntu:24.04:LTS | canonical | linux-gkeop |
< 6.8.0-1030.33 Fix: upgrade to 6.8.0-1030.33
|
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-ibm |
< 6.8.0-1044.44 Fix: upgrade to 6.8.0-1044.44
|
| Ubuntu:24.04:LTS | canonical | linux-intel | All versions |
| Ubuntu:24.04:LTS | canonical | linux-lowlatency |
< 6.8.0-100.100.1 Fix: upgrade to 6.8.0-100.100.1
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia |
< 6.8.0-1046.49 Fix: upgrade to 6.8.0-1046.49
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-lowlatency |
< 6.8.0-1046.49.1 Fix: upgrade to 6.8.0-1046.49.1
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.14 |
< 6.14.0-1014.14 Fix: upgrade to 6.14.0-1014.14
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle |
< 6.8.0-1043.44 Fix: upgrade to 6.8.0-1043.44
|
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.14 |
< 6.14.0-1015.15~24.04.1 Fix: upgrade to 6.14.0-1015.15~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-raspi |
< 6.8.0-1047.51 Fix: upgrade to 6.8.0-1047.51
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.14 |
< 6.14.0-34.34.1~24.04.1 Fix: upgrade to 6.14.0-34.34.1~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-xilinx |
< 6.8.0-1023.24 Fix: upgrade to 6.8.0-1023.24
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-aws-fips |
< 6.8.0-1046.49+fips1 Fix: upgrade to 6.8.0-1046.49+fips1
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-azure-fips |
< 6.8.0-1046.52+fips1 Fix: upgrade to 6.8.0-1046.52+fips1
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-fips |
< 6.8.0-100.100+fips1 Fix: upgrade to 6.8.0-100.100+fips1
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-gcp-fips |
< 6.8.0-1047.50+fips1 Fix: upgrade to 6.8.0-1047.50+fips1
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-raspi-realtime |
< 6.8.0-2037.38 Fix: upgrade to 6.8.0-2037.38
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime |
< 6.8.1-1041.42 Fix: upgrade to 6.8.1-1041.42
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.14 |
< 6.14.0-1014.14~24.04.1 Fix: upgrade to 6.14.0-1014.14~24.04.1
|
| Ubuntu:25.10 | canonical | linux-azure-fde | All versions |
| Root:Debian:12 | debian | rootio-linux |
< 6.1.164-1.root.io.108 Fix: upgrade to 6.1.164-1.root.io.108
|
| Root:Ubuntu:22.04 | canonical | linux |
< 5.15.0-187.197.aikido.112 Fix: upgrade to 5.15.0-187.197.aikido.112
|
| Root:Ubuntu:22.04 | canonical | rootio-linux |
< 5.15.0-187.197.aikido.112 Fix: upgrade to 5.15.0-187.197.aikido.112
|
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield |
< 6.8.0-1016.20 Fix: upgrade to 6.8.0-1016.20
|
| Root:Ubuntu:24.04 | – | linux |
< 6.8.0-146.146.aikido.89 < 6.8.0-147.147.aikido.90 Fix: upgrade to 6.8.0-146.146.aikido.89
|
| Root:Ubuntu:24.04 | – | rootio-linux |
< 6.8.0-146.146.aikido.89 < 6.8.0-147.147.aikido.90 Fix: upgrade to 6.8.0-146.146.aikido.89
|
| Root:Ubuntu:22.04 | – | linux |
< 5.15.0-198.208.aikido.116 < 5.15.0-202.212.aikido.118 Fix: upgrade to 5.15.0-198.208.aikido.116
|
| Root:Ubuntu:22.04 | – | rootio-linux |
< 5.15.0-198.208.aikido.116 < 5.15.0-202.212.aikido.118 Fix: upgrade to 5.15.0-198.208.aikido.116
|
| Linux | linux | kernel |
>= 6.13.0, < 6.15.4 Fix: upgrade to 6.15.4
|
| Root:Debian:12 | – | linux |
< 6.1.190-1.aikido.167 Fix: upgrade to 6.1.190-1.aikido.167
|
| Root:Debian:12 | – | rootio-linux |
< 6.1.190-1.aikido.167 Fix: upgrade to 6.1.190-1.aikido.167
|
Original advisory text
CVE-2025-38334 in linux - Patched by Root
In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Prevent attempts to reclaim poisoned pages TL;DR: SGX page reclaim touches the page to copy its contents to secondary storage. SGX instructions do not gracefully handle machine checks. Despite this, the existing SGX code will try to reclaim pages that it _knows_ are poisoned. Avoid even trying to reclaim poisoned pages. The longer story: Pages used by an enclave only get epc_page->poison set in arch_memory_failure() but they currently stay on sgx_active_page_list until sgx_encl_release(), with the SGX_EPC_PAGE_RECLAIMER_TRACKED flag untouched. epc_page->poison is not checked in the reclaimer logic meaning that, if other conditions are met, an attempt will be made to reclaim an EPC page that was poisoned. This is bad because 1. we don't want that page to end up added to another enclave and 2. it is likely to cause one core to shut down and the kernel to panic. Specifically, reclaiming uses microcode operations including "EWB" which accesses the EPC page contents to encrypt and write them out to non-SGX memory. Those operations cannot handle MCEs in their accesses other than by putting the executing core into a special shutdown state (affecting both threads with HT.) The kernel will subsequently panic on the remaining cores seeing the core didn't enter MCE handler(s) in time. Call sgx_unmark_page_reclaimable() to remove the affected EPC page from sgx_active_page_list on memory error to stop it being considered for reclaiming. Testing epc_page->poison in sgx_reclaim_pages() would also work but I assume it's better to add code in the less likely paths. The affected EPC page is not added to &node->sgx_poison_page_list until later in sgx_encl_release()->sgx_free_epc_page() when it is EREMOVEd. Membership on other lists doesn't change to avoid changing any of the lists' semantics except for sgx_active_page_list. There's a "TBD" comment in arch_memory_failure() about pre-emptive actions, the goal here is not to address everything that it may imply. This also doesn't completely close the time window when a memory error notification will be fatal (for a not previously poisoned EPC page) -- the MCE can happen after sgx_reclaim_pages() has selected its candidates or even *inside* a microcode operation (actually easy to trigger due to the amount of time spent in them.) The spinlock in sgx_unmark_page_reclaimable() is safe because memory_failure() runs in process context and no spinlocks are held, explicitly noted in a mm/memory-failure.c comment.
References
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://ubuntu.com/security/notices/USN-7833-3 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7856-1 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-38334 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38334... Vendor Advisory
- https://ubuntu.com/security/notices/USN-8028-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8028-4 Vendor Advisory
- https://git.kernel.org/stable/c/00a88e9ea1b170d579c56327c38f7e8cf689df87 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html URL
- https://git.kernel.org/stable/c/31dcbac94bfeabb86bf85b0c36803fdd6536437b Third Party Advisory
- https://ubuntu.com/security/notices/USN-8028-6 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8031-3 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8028-7 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8052-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8074-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8074-2 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-38334 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-38334 Third Party Advisory
- https://git.kernel.org/linus/ed16618c380c32c68c06186d0ccbb0d5e0586e59 Third Party Advisory
- https://git.kernel.org/stable/c/62b62a2a6dc51ed6e8e334861f04220c9cf8106a Third Party Advisory
- https://git.kernel.org/stable/c/dc5de5bd6deabd327ced2b2b1d0b4f14cd146afe Third Party Advisory
- https://git.kernel.org/stable/c/ed16618c380c32c68c06186d0ccbb0d5e0586e59 Third Party Advisory
- https://ubuntu.com/security/notices/USN-7833-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7834-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7833-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7833-4 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8028-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8031-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8028-3 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8028-5 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8031-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8052-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8028-8 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8126-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-754Improper Check for Unusual or Exceptional Conditions
Timeline
Published10 Jul 2025
Updated30 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta