Linux Kernel up to 6.12.33/6.14.9/6.15.0 arm64 privilege escalation

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.12.33/6.14.9/6.15.0. It has been classified as problematic. Impacted is an unknown function of the component arm64. The manipulation leads to an unknown weakness. This vulnerability is uniquely identified as CVE-2025-38093. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.12.33/6.14.9/6.15.0 and classified as problematic. This issue affects an unknown code block of the component arm64. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: x1e80100: Add GPU cooling Unlike the CPU, the GPU does not throttle its speed automatically when it reaches high temperatures. With certain high GPU loads it is possible to reach the critical hardware shutdown temperature of 120°C, endangering the hardware and making it impossible to run certain applications. Set up GPU cooling similar to the ACPI tables, by throttling the GPU speed when reaching 95°C and polling every 200ms.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2025-38093 since 04/16/2025. The exploitation is known to be difficult. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 6.12.34, 6.14.10, 6.15.1 or 6.16-rc1 eliminates this vulnerability. Applying the patch cd9d354bdd28b20a8f3170dab3bc0f096e66d6b4/ae664ca09072857349857530dce12e09c048b12d/d145a6a3e252f093dc243d2944fecb2387a3d690/5ba21fa11f473c9827f378ace8c9f983de9e0287 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-19732) and CERT Bund (WID-SEC-2025-1452). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• IBM QRadar SIEM
• SUSE openSUSE
• RESF Rocky Linux
• Dell Avamar
• Open Source Linux Kernel
• Dell NetWorker
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4
• 6.12.5
• 6.12.6
• 6.12.7
• 6.12.8
• 6.12.9
• 6.12.10
• 6.12.11
• 6.12.12
• 6.12.13
• 6.12.14
• 6.12.15
• 6.12.16
• 6.12.17
• 6.12.18
• 6.12.19
• 6.12.20
• 6.12.21
• 6.12.22
• 6.12.23
• 6.12.24
• 6.12.25
• 6.12.26
• 6.12.27
• 6.12.28
• 6.12.29
• 6.12.30
• 6.12.31
• 6.12.32
• 6.12.33
• 6.13
• 6.14
• 6.14.0
• 6.14.1
• 6.14.2
• 6.14.3
• 6.14.4
• 6.14.5
• 6.14.6
• 6.14.7
• 6.14.8
• 6.14.9
• 6.15.0

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion