cve 2025 38115

CVE-2025-38115 is a Linux kernel vulnerability in the network scheduler's Stochastic Gradient Descent (SGD) component. Microsoft has confirmed that Azure Linux includes the vulnerable code path and is a remediation priority. However, other Microsoft-distributed Linux artifacts, such as the WSL2 kernel and Marketplace images, remain unverified unless Microsoft publishes a specific attestation. The tag covers discussions about the scope of the vulnerability across Microsoft products, the importance of verifying each artifact independently, and the need for patching. Users should treat Azure Linux as confirmed affected and treat other Microsoft Linux distributions as potentially vulnerable until proven otherwise.