CVE-2025-38047

Medium

In the Linux kernel, the following vulnerability has been resolved: x86/fred: Fix system hang during S4 resume with FRED enabled Upon a wakeup from S4, the restore kernel starts and initializes the FRED MSRs as needed from its perspective. It then loads a hibernation image, including the image kernel, and attempts to load image pages directly into their original page frames used before hibernation unless those frames are currently in use. Once all pages are moved to their original locations, it jumps to a "trampoline" page in the image kernel. At this point, the image kernel takes control, but the FRED MSRs still contain values set by the restore kernel, which may differ from those set by the image kernel before hibernation. Therefore, the image kernel must ensure the FRED MSRs have the same values as before hibernation. Since these values depend only on the location of the kernel text and data, they can be recomputed from scratch.

Package Linux Kernel
Published 2025-06-18
Last modified 2025-11-14
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

5.5

out of 10
Medium
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 6.9 and later are affected. Fixed in 6.12.31, 6.14.9, 6.15 and their respective stable series.

Affected from
≥ 6.9
Fixed in
✓ 6.12.31 6.12.x ✓ 6.14.9 6.14.x ✓ 6.15

References

The following references provide additional information about CVE-2025-38047 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

Frequently asked questions

  • What is CVE-2025-38047?

    CVE-2025-38047 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 6.9 onward and has been patched in 6.12.31, 6.14.9 and 6.15. CVE-2025-38047 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2025-38047?

    CVE-2025-38047 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H .

  • Is there a patch available for CVE-2025-38047?

    Yes — CVE-2025-38047 has been patched. Fixed versions include 6.12.31, 6.14.9 and 6.15. If you are running Linux kernel 6.9 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2025-38047 actively exploited?

    No — CVE-2025-38047 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST