In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Check return value from memblockphysalloc_range()
At least with CONFIGPHYSICALSTART=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblockphysallocrange() returns 0 on failure, which leads memblockphys_free() to throw the first 4 MiB of physical memory to the wolves.
At a minimum it should fail gracefully with a meaningful diagnostic, but in fact everything seems to work fine without the weird reserve allocation.
[
{
"target": {
"function": "memory_map_top_down",
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-1a0e7d46",
"digest": {
"function_hash": "41090267295910011582125676559865377892",
"length": 689.0
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@631ca8909fd5c62b9fda9edda93924311a78a9c4",
"signature_type": "Function"
},
{
"target": {
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-1f3dd694",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316895915011399856787191546392671541637",
"141929042046125772594418577068956323570",
"12527080858825243461820167944026730236",
"2799029588382225524342099779621767842",
"88563095226267599130723772410437866773"
]
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@631ca8909fd5c62b9fda9edda93924311a78a9c4",
"signature_type": "Line"
},
{
"target": {
"function": "memory_map_top_down",
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-34047fdd",
"digest": {
"function_hash": "41090267295910011582125676559865377892",
"length": 689.0
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6f2694c580c27dca0cf7546ee9b4bfa6b940e38",
"signature_type": "Function"
},
{
"target": {
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-47d1a5b4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316895915011399856787191546392671541637",
"141929042046125772594418577068956323570",
"12527080858825243461820167944026730236",
"2799029588382225524342099779621767842",
"88563095226267599130723772410437866773"
]
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c18c904d301ffeb33b071eadc55cd6131e1e9be",
"signature_type": "Line"
},
{
"target": {
"function": "memory_map_top_down",
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-4bf3281b",
"digest": {
"function_hash": "41090267295910011582125676559865377892",
"length": 689.0
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dde4800d2b0f68b945fd81d4fc2d4a10ae25f743",
"signature_type": "Function"
},
{
"target": {
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-4d132b86",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316895915011399856787191546392671541637",
"141929042046125772594418577068956323570",
"12527080858825243461820167944026730236",
"2799029588382225524342099779621767842",
"88563095226267599130723772410437866773"
]
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bffd5f2815c5234d609725cd0dc2f4bc5de2fc67",
"signature_type": "Line"
},
{
"target": {
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-8c217135",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316895915011399856787191546392671541637",
"141929042046125772594418577068956323570",
"12527080858825243461820167944026730236",
"2799029588382225524342099779621767842",
"88563095226267599130723772410437866773"
]
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6f2694c580c27dca0cf7546ee9b4bfa6b940e38",
"signature_type": "Line"
},
{
"target": {
"function": "memory_map_top_down",
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-d191ed0d",
"digest": {
"function_hash": "41090267295910011582125676559865377892",
"length": 689.0
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bffd5f2815c5234d609725cd0dc2f4bc5de2fc67",
"signature_type": "Function"
},
{
"target": {
"function": "memory_map_top_down",
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-e32ab47f",
"digest": {
"function_hash": "41090267295910011582125676559865377892",
"length": 689.0
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c18c904d301ffeb33b071eadc55cd6131e1e9be",
"signature_type": "Function"
},
{
"target": {
"file": "arch/x86/mm/init.c"
},
"id": "CVE-2025-38071-f1a01e45",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316895915011399856787191546392671541637",
"141929042046125772594418577068956323570",
"12527080858825243461820167944026730236",
"2799029588382225524342099779621767842",
"88563095226267599130723772410437866773"
]
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dde4800d2b0f68b945fd81d4fc2d4a10ae25f743",
"signature_type": "Line"
}
]