CVE-2025-38366: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check validity of "num_cpu" from user space The maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about irqchip EIOINTC, here add validation about cpu number to avoid array pointer overflow.

Affected products

• Linux Linux Kernel: from 6.13, before 6.15.5 (fixed in 6.15.5); version 6.16 only

Published 2025-07-25. Last modified 2026-07-30.