CVE-2025-38408

A flaw was found in the Linux kernel's genirq/irq_sim module, rated by Red Hat as moderate impact, affecting the kernel and kernel-rt components of Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10. The irq_sim simulation work context was allocated with kmalloc() instead of kzalloc(), leaving the pointers of the ops member with uninitialized, random content that can be invalidly dereferenced, causing incorrect memory access. A local attacker could exploit this improper pointer initialization to crash the system, resulting in a denial of service. Red Hat Enterprise Linux 6, 7, and 8, and Red Hat In-Vehicle OS 1 are not affected because the vulnerable code is not present in those products. Red Hat rates this flaw lower (CVSS 4.1) than NIST (5.5) because exploitation requires local access with high privileges and is difficult to perform, and the impact is limited to system availability. Fixes for the affected Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 streams are deferred, so no fix is currently planned for these streams; the residual risk is a local denial of service, with no impact on confidentiality or integrity.