CVE-2025-38334

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/sgx: Prevent attempts to reclaim poisoned pages

TL;DR: SGX page reclaim touches the page to copy its contents to

secondary storage. SGX instructions do not gracefully handle machine

checks. Despite this, the existing SGX code will try to reclaim pages

that it _knows_ are poisoned. Avoid even trying to reclaim poisoned pages.

The longer story:

Pages used by an enclave only get epc_page->poison set in

arch_memory_failure() but they currently stay on sgx_active_page_list until

sgx_encl_release(), with the SGX_EPC_PAGE_RECLAIMER_TRACKED flag untouched.

epc_page->poison is not checked in the reclaimer logic meaning that, if other

conditions are met, an attempt will be made to reclaim an EPC page that was

poisoned. This is bad because 1. we don't want that page to end up added

to another enclave and 2. it is likely to cause one core to shut down

and the kernel to panic.

Specifically, reclaiming uses microcode oper

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References