---
id: CVE-2025-38067
title: 'rseq: Fix segfault on registration when rseq_cs is non-zero'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rseq: Fix segfault on registration when rseq_cs is non-zero

  The rseq_cs field is documented as being set to 0 by user-space prior to
  registration, however this is not …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 <
    48900d839a3454050fd5822e34be8d54c4ec9b86
  - >-
    Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 <
    3e4028ef31b69286c9d4878cee0330235f53f218
  - >-
    Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 <
    b2b05d0dc2f4f0646922068af435aed5763d16ba
  - >-
    Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 <
    eaf112069a904b6207b4106ff083e0208232a2eb
  - >-
    Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 <
    f004f58d18a2d3dc761cf973ad27b4a5997bd876
  - >-
    Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 <
    2df285dab00fa03a3ef939b6cb0d0d0aeb0791db
  - >-
    Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 <
    fd881d0a085fc54354414aed990ccf05f282ba53
  - Linux 4.18
published: '2025-06-18'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:06:26.314Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38067'
references:
  - url: 'https://git.kernel.org/stable/c/48900d839a3454050fd5822e34be8d54c4ec9b86'
  - url: 'https://git.kernel.org/stable/c/3e4028ef31b69286c9d4878cee0330235f53f218'
  - url: 'https://git.kernel.org/stable/c/b2b05d0dc2f4f0646922068af435aed5763d16ba'
  - url: 'https://git.kernel.org/stable/c/eaf112069a904b6207b4106ff083e0208232a2eb'
  - url: 'https://git.kernel.org/stable/c/f004f58d18a2d3dc761cf973ad27b4a5997bd876'
  - url: 'https://git.kernel.org/stable/c/2df285dab00fa03a3ef939b6cb0d0d0aeb0791db'
  - url: 'https://git.kernel.org/stable/c/fd881d0a085fc54354414aed990ccf05f282ba53'
tags:
  - cve.org
epss: 0.0058
epssPercentile: 0.47506
ingestedAt: '2026-10-15T05:52:46.097Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rseq: Fix segfault on registration when rseq_cs is non-zero

The rseq_cs field is documented as being set to 0 by user-space prior to
registration, however this is not currently enforced by the kernel. This
can result in a segfault on return to user-space if the value stored in
the rseq_cs field doesn't point to a valid struct rseq_cs.

The correct solution to this would be to fail the rseq registration when
the rseq_cs field is non-zero. However, some older versions of glibc
will reuse the rseq area of previous threads without clearing the
rseq_cs field and will also terminate the process if the rseq
registration fails in a secondary thread. This wasn't caught in testing
because in this case the leftover rseq_cs does point to a valid struct
rseq_cs.

What we can do is clear the rseq_cs field on registration when it's
non-zero which will prevent segfaults on registration and won't break
the glibc versions that reuse rseq areas on thread creation.

## Affected

- `Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 < 48900d839a3454050fd5822e34be8d54c4ec9b86`
- `Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 < 3e4028ef31b69286c9d4878cee0330235f53f218`
- `Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 < b2b05d0dc2f4f0646922068af435aed5763d16ba`
- `Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 < eaf112069a904b6207b4106ff083e0208232a2eb`
- `Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 < f004f58d18a2d3dc761cf973ad27b4a5997bd876`
- `Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 < 2df285dab00fa03a3ef939b6cb0d0d0aeb0791db`
- `Linux >= d7822b1e24f2df5df98c76f0e94a5416349ff759 < fd881d0a085fc54354414aed990ccf05f282ba53`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.