Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0013 3.0 —
AFFECTED Product Versions Fixed Linux 36f257e3b0ba904f5a4e7fa8dafaa60e88cdd28c – — Linux 6.15 – 6.15.5
TIMELINE Apr 16 Reserved by Linux Jul 9 Published (CNA: Linux) Jul 30 RESCORED — CVE-2025-38252 (Linux). CVSS 7.8 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix CPER handler device confusion By inspection, cxl_cper_handle_prot_err() is making a series of fragile assumptions that can lead to crashes: 1/ It assumes that endpoints identified in the record are a CXL-type-3 device, nothing guarantees that. 2/ It assumes that the device is bound to the cxl_pci driver, nothing guarantees that. 3/ Minor, it holds the device lock over the switch-port tracing for no reason as the trace is 100% generated from data in the record. Correct those by checking that the PCIe endpoint parents a cxl_memdev before assuming the format of the driver data, and move the lock to where it is required. Consequently this also makes the implementation ready for CXL accelerators that are not bound to cxl_pci.
| Date | Event | Detail |
|---|---|---|
| April 16, 2025 | Reserved | Reserved by Linux |
| July 9, 2025 | Published | Published (CNA: Linux) |
| July 30, 2026 | RESCORED | RESCORED — CVE-2025-38252 (Linux). CVSS 7.8 → 5.5 (NVD). |
Authoritative record: CVE-2025-38252 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-38252 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.