---
id: CVE-2025-38071
title: 'x86/mm: Check return value from memblock_phys_alloc_range()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  x86/mm: Check return value from memblock_phys_alloc_range()

  At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of
  contiguous free memory available at th…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 <
    8c18c904d301ffeb33b071eadc55cd6131e1e9be
  - >-
    Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 <
    bffd5f2815c5234d609725cd0dc2f4bc5de2fc67
  - >-
    Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 <
    c6f2694c580c27dca0cf7546ee9b4bfa6b940e38
  - >-
    Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 <
    dde4800d2b0f68b945fd81d4fc2d4a10ae25f743
  - >-
    Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 <
    631ca8909fd5c62b9fda9edda93924311a78a9c4
  - Linux 5.15
published: '2025-06-18'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:06:27.679Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38071'
references:
  - url: 'https://git.kernel.org/stable/c/8c18c904d301ffeb33b071eadc55cd6131e1e9be'
  - url: 'https://git.kernel.org/stable/c/bffd5f2815c5234d609725cd0dc2f4bc5de2fc67'
  - url: 'https://git.kernel.org/stable/c/c6f2694c580c27dca0cf7546ee9b4bfa6b940e38'
  - url: 'https://git.kernel.org/stable/c/dde4800d2b0f68b945fd81d4fc2d4a10ae25f743'
  - url: 'https://git.kernel.org/stable/c/631ca8909fd5c62b9fda9edda93924311a78a9c4'
tags:
  - cve.org
epss: 0.00189
epssPercentile: 0.0842
ingestedAt: '2026-10-15T05:52:46.097Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Check return value from memblock_phys_alloc_range()

At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of
contiguous free memory available at this point, the kernel will crash
and burn because memblock_phys_alloc_range() returns 0 on failure,
which leads memblock_phys_free() to throw the first 4 MiB of physical
memory to the wolves.

At a minimum it should fail gracefully with a meaningful diagnostic,
but in fact everything seems to work fine without the weird reserve
allocation.

## Affected

- `Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 < 8c18c904d301ffeb33b071eadc55cd6131e1e9be`
- `Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 < bffd5f2815c5234d609725cd0dc2f4bc5de2fc67`
- `Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 < c6f2694c580c27dca0cf7546ee9b4bfa6b940e38`
- `Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 < dde4800d2b0f68b945fd81d4fc2d4a10ae25f743`
- `Linux >= a7259df7670240ee03b0cfce8a3e5d3773911e24 < 631ca8909fd5c62b9fda9edda93924311a78a9c4`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.