CVE-2025-38466

This vulnerability in the Linux kernel's uprobe mechanism allows unprivileged users to insert probes in the middle of instructions, causing undefined behavior. The kernel only checks for a valid instruction at the requested offset, but due to variable instruction length, it cannot guarantee the probe aligns with an actual executed instruction. On architectures like arm64 that mix data in the text segment, a data word could be misinterpreted as an instruction, leading to similar issues. [1]

To exploit, an attacker needs local access and the ability to set uprobes. Previously, CAP_SYS_ADMIN was not required, making this a privilege escalation vector. The attack can cause system instability, crashes, or potentially arbitrary code execution if the probe is placed in a critical path. [1]

The impact is a denial of service or privilege escalation, as an unprivileged user can disrupt system operation. [1]

The fix reverts uprobes to require CAP_SYS_ADMIN, patched in kernel stable commits [2], [3], [4]. Siemens advisory SSA-082556 lists affected industrial products with upcoming updates. [1]