In the Linux kernel, the following vulnerability has been resolved:
x86/iopl: Cure TIFIOBITMAP inconsistencies
iobitmapexit() is invoked from exitthread() when a task exists or when a fork fails. In the latter case the exitthread() cleans up resources which were allocated during fork().
iobitmapexit() invokes taskupdateiobitmap(), which in turn ends up in tssupdateiobitmap(). tssupdateiobitmap() operates on the current task. If current has TIFIOBITMAP set, but no bitmap installed, tssupdateiobitmap() crashes with a NULL pointer dereference.
There are two issues, which lead to that problem:
1) iobitmapexit() should not invoke taskupdateio_bitmap() when the task, which is cleaned up, is not the current task. That's a clear indicator for a cleanup after a failed fork().
2) A task should not have TIFIOBITMAP set and neither a bitmap installed nor IOPL emulation level 3 activated.
This happens when a kernel thread is created in the context of
a user space thread, which has TIF_IO_BITMAP set as the thread
flags are copied and the IO bitmap pointer is cleared.
Other than in the failed fork() case this has no impact because
kernel threads including IO workers never return to user space and
therefore never invoke tss_update_io_bitmap().
Cure this by adding the missing cleanups and checks:
1) Prevent iobitmapexit() to invoke taskupdateio_bitmap() if the to be cleaned up task is not the current task.
2) Clear TIFIOBITMAP in copythread() unconditionally. For user space forks it is set later, when the IO bitmap is inherited in iobitmap_share().
For paranoia sake, add a warning into tssupdateio_bitmap() to catch the case, when that code is invoked with inconsistent state.
[
{
"id": "CVE-2025-38100-06080e05",
"digest": {
"line_hashes": [
"14364169773429802497521604269276959217",
"77500729684065523161586401111425910172",
"198401306871373808364428114475958678710",
"148273497675772066305775375112252346835",
"41828564864884630023666205376023828381",
"13810592184014155251301497045906979372",
"277796850334095284963807955076308033393",
"33115433162381276549657039648976946365",
"229179012315797113043675712994918980105",
"100408144914677785993532383203264482125",
"248221241365073494328382094538674513494",
"184338404761662744302280527793290310955",
"208575557864651648323928506528356410512"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5ce1485562f20235b4c759eee5ab0c41d2c220"
},
{
"id": "CVE-2025-38100-0857b048",
"digest": {
"length": 200.0,
"function_hash": "16918645633030689516802587486473463264"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "io_bitmap_exit"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5ce1485562f20235b4c759eee5ab0c41d2c220"
},
{
"id": "CVE-2025-38100-15083e59",
"digest": {
"line_hashes": [
"18110969446795590502548684628933860627",
"293945531912360908804450844920757612606",
"227505626182840761774864924962359136234",
"4911875958301020089565987688142757264",
"339276617060068393665797991376220999016",
"297869029786578395587053884595034634724",
"91820091929899349447062559880872832238"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d64b7b05a827f98d068f412969eef65489b0cf03"
},
{
"id": "CVE-2025-38100-180ecb2f",
"digest": {
"length": 200.0,
"function_hash": "16918645633030689516802587486473463264"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "io_bitmap_exit"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d64b7b05a827f98d068f412969eef65489b0cf03"
},
{
"id": "CVE-2025-38100-1f2eb0d3",
"digest": {
"length": 507.0,
"function_hash": "329403208663279932037542339570698616723"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c",
"function": "native_tss_update_io_bitmap"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cfcbe1554c119402e7382de974c26b0549899fe"
},
{
"id": "CVE-2025-38100-277d1abb",
"digest": {
"length": 364.0,
"function_hash": "293747807811551926292004094004465463942"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "SYSCALL_DEFINE1"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d64b7b05a827f98d068f412969eef65489b0cf03"
},
{
"id": "CVE-2025-38100-3ac724c0",
"digest": {
"length": 258.0,
"function_hash": "316558776155732906062955543616504351467"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "task_update_io_bitmap"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5ce1485562f20235b4c759eee5ab0c41d2c220"
},
{
"id": "CVE-2025-38100-55933707",
"digest": {
"line_hashes": [
"29812752502103872898873966262239374274",
"98999360286223341496801906039872752473",
"227505626182840761774864924962359136234",
"4911875958301020089565987688142757264",
"339276617060068393665797991376220999016",
"297869029786578395587053884595034634724",
"91820091929899349447062559880872832238"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73cfcc8445585b8af7e18be3c9246b851fdf336c"
},
{
"id": "CVE-2025-38100-6a08594c",
"digest": {
"line_hashes": [
"14364169773429802497521604269276959217",
"77500729684065523161586401111425910172",
"198401306871373808364428114475958678710",
"148273497675772066305775375112252346835",
"41828564864884630023666205376023828381",
"13810592184014155251301497045906979372",
"277796850334095284963807955076308033393",
"33115433162381276549657039648976946365",
"229179012315797113043675712994918980105",
"100408144914677785993532383203264482125",
"248221241365073494328382094538674513494",
"184338404761662744302280527793290310955",
"208575557864651648323928506528356410512"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cfcbe1554c119402e7382de974c26b0549899fe"
},
{
"id": "CVE-2025-38100-7a16ecae",
"digest": {
"length": 258.0,
"function_hash": "316558776155732906062955543616504351467"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "task_update_io_bitmap"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d64b7b05a827f98d068f412969eef65489b0cf03"
},
{
"id": "CVE-2025-38100-8052f9c9",
"digest": {
"line_hashes": [
"14364169773429802497521604269276959217",
"77500729684065523161586401111425910172",
"198401306871373808364428114475958678710",
"148273497675772066305775375112252346835",
"41828564864884630023666205376023828381",
"13810592184014155251301497045906979372",
"277796850334095284963807955076308033393",
"33115433162381276549657039648976946365",
"229179012315797113043675712994918980105",
"100408144914677785993532383203264482125",
"248221241365073494328382094538674513494",
"184338404761662744302280527793290310955",
"208575557864651648323928506528356410512"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d64b7b05a827f98d068f412969eef65489b0cf03"
},
{
"id": "CVE-2025-38100-90fd295e",
"digest": {
"length": 364.0,
"function_hash": "293747807811551926292004094004465463942"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "SYSCALL_DEFINE1"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cfcbe1554c119402e7382de974c26b0549899fe"
},
{
"id": "CVE-2025-38100-a0e7db89",
"digest": {
"length": 507.0,
"function_hash": "329403208663279932037542339570698616723"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c",
"function": "native_tss_update_io_bitmap"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d64b7b05a827f98d068f412969eef65489b0cf03"
},
{
"id": "CVE-2025-38100-a21802c9",
"digest": {
"length": 200.0,
"function_hash": "16918645633030689516802587486473463264"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "io_bitmap_exit"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73cfcc8445585b8af7e18be3c9246b851fdf336c"
},
{
"id": "CVE-2025-38100-a27992f6",
"digest": {
"length": 364.0,
"function_hash": "293747807811551926292004094004465463942"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "SYSCALL_DEFINE1"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5ce1485562f20235b4c759eee5ab0c41d2c220"
},
{
"id": "CVE-2025-38100-a457a8e5",
"digest": {
"length": 507.0,
"function_hash": "329403208663279932037542339570698616723"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c",
"function": "native_tss_update_io_bitmap"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5ce1485562f20235b4c759eee5ab0c41d2c220"
},
{
"id": "CVE-2025-38100-ae7840d0",
"digest": {
"line_hashes": [
"18110969446795590502548684628933860627",
"293945531912360908804450844920757612606",
"227505626182840761774864924962359136234",
"4911875958301020089565987688142757264",
"339276617060068393665797991376220999016",
"297869029786578395587053884595034634724",
"91820091929899349447062559880872832238"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5ce1485562f20235b4c759eee5ab0c41d2c220"
},
{
"id": "CVE-2025-38100-b3bc72d6",
"digest": {
"line_hashes": [
"29812752502103872898873966262239374274",
"98999360286223341496801906039872752473",
"227505626182840761774864924962359136234",
"4911875958301020089565987688142757264",
"339276617060068393665797991376220999016",
"297869029786578395587053884595034634724",
"91820091929899349447062559880872832238"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cfcbe1554c119402e7382de974c26b0549899fe"
},
{
"id": "CVE-2025-38100-b7848939",
"digest": {
"length": 258.0,
"function_hash": "316558776155732906062955543616504351467"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "task_update_io_bitmap"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73cfcc8445585b8af7e18be3c9246b851fdf336c"
},
{
"id": "CVE-2025-38100-bb168d98",
"digest": {
"length": 1637.0,
"function_hash": "180264085670566598359576131805382210715"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c",
"function": "copy_thread"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d64b7b05a827f98d068f412969eef65489b0cf03"
},
{
"id": "CVE-2025-38100-c10d76e4",
"digest": {
"length": 2051.0,
"function_hash": "227581916223749124352455028305816893783"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c",
"function": "copy_thread"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cfcbe1554c119402e7382de974c26b0549899fe"
},
{
"id": "CVE-2025-38100-c85e173a",
"digest": {
"length": 364.0,
"function_hash": "293747807811551926292004094004465463942"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "SYSCALL_DEFINE1"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73cfcc8445585b8af7e18be3c9246b851fdf336c"
},
{
"id": "CVE-2025-38100-c9df827d",
"digest": {
"length": 507.0,
"function_hash": "329403208663279932037542339570698616723"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c",
"function": "native_tss_update_io_bitmap"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73cfcc8445585b8af7e18be3c9246b851fdf336c"
},
{
"id": "CVE-2025-38100-d17c0a4e",
"digest": {
"length": 200.0,
"function_hash": "16918645633030689516802587486473463264"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "io_bitmap_exit"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cfcbe1554c119402e7382de974c26b0549899fe"
},
{
"id": "CVE-2025-38100-d7bddff3",
"digest": {
"length": 258.0,
"function_hash": "316558776155732906062955543616504351467"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c",
"function": "task_update_io_bitmap"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cfcbe1554c119402e7382de974c26b0549899fe"
},
{
"id": "CVE-2025-38100-e602bc24",
"digest": {
"line_hashes": [
"14364169773429802497521604269276959217",
"77500729684065523161586401111425910172",
"198401306871373808364428114475958678710",
"148273497675772066305775375112252346835",
"41828564864884630023666205376023828381",
"13810592184014155251301497045906979372",
"277796850334095284963807955076308033393",
"33115433162381276549657039648976946365",
"229179012315797113043675712994918980105",
"100408144914677785993532383203264482125",
"248221241365073494328382094538674513494",
"184338404761662744302280527793290310955",
"208575557864651648323928506528356410512"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/ioport.c"
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73cfcc8445585b8af7e18be3c9246b851fdf336c"
},
{
"id": "CVE-2025-38100-e9a6bceb",
"digest": {
"length": 2051.0,
"function_hash": "227581916223749124352455028305816893783"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c",
"function": "copy_thread"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73cfcc8445585b8af7e18be3c9246b851fdf336c"
},
{
"id": "CVE-2025-38100-eef8018d",
"digest": {
"length": 1762.0,
"function_hash": "245328724123850103104778109457613412941"
},
"signature_version": "v1",
"target": {
"file": "arch/x86/kernel/process.c",
"function": "copy_thread"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa5ce1485562f20235b4c759eee5ab0c41d2c220"
}
]