CVE-2025-37916

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37916

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: pds_core: remove write-after-free of client_id A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47): [Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0x70 [Mon Apr 21 21:21:33 2025] device_release_driver_internal+0x11f/0x180 [Mon Apr 21 21:21:33 2025] driver_detach+0x45/0x80 [Mon Apr 21 21:21:33 2025] bus_remove_driver+0x83/0xe0 [Mon Apr 21 21:21:33 2025] pci_unregister_driver+0x1a/0x80 The actual device uninit usually happens on a separate thread scheduled after this code runs, but there is no guarantee of order of thread execution, so this could be a problem. There's no actual need to clear the client_id at this point, so simply remove the offending code.

References
Link Resource
https://git.kernel.org/stable/c/26dc701021302f11c8350108321d11763bd81dfe Patch
https://git.kernel.org/stable/c/9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b Patch
https://git.kernel.org/stable/c/c649b9653ed09196e91d3f4b16b679041b3c42e6 Patch
https://git.kernel.org/stable/c/dfd76010f8e821b66116dec3c7d90dd2403d1396 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
History

17 Nov 2025, 17:03

Type Values Removed Values Added
CWE CWE-416
References () https://git.kernel.org/stable/c/26dc701021302f11c8350108321d11763bd81dfe - () https://git.kernel.org/stable/c/26dc701021302f11c8350108321d11763bd81dfe - Patch
References () https://git.kernel.org/stable/c/9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b - () https://git.kernel.org/stable/c/9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b - Patch
References () https://git.kernel.org/stable/c/c649b9653ed09196e91d3f4b16b679041b3c42e6 - () https://git.kernel.org/stable/c/c649b9653ed09196e91d3f4b16b679041b3c42e6 - Patch
References () https://git.kernel.org/stable/c/dfd76010f8e821b66116dec3c7d90dd2403d1396 - () https://git.kernel.org/stable/c/dfd76010f8e821b66116dec3c7d90dd2403d1396 - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

21 May 2025, 20:25

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pds_core: eliminar escritura use-after-free de client_id Apareció un error de use-after-free en las pruebas de estrés: [Lun 21 Abr 21:21:33 2025] ERROR: KFENCE: escritura use-after-free en pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Lun 21 Abr 21:21:33 2025] Escritura use-after-free en 0x000000007013ecd1 (en kfence-#47): [Lun 21 Abr 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Lun 21 Abr 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Lun 21 Abr 21:21:33 2025] pci_device_remove+0x24/0x70 [Lun 21 Abr 21:21:33 2025] device_release_driver_internal+0x11f/0x180 [Lun 21 Abr 21:21:33 2025] driver_detach+0x45/0x80 [Lun 21 Abr 21:21:33 2025] bus_remove_driver+0x83/0xe0 [Lun 21 Abr 21:21:33 2025] pci_unregister_driver+0x1a/0x80 La desinicialización real del dispositivo suele ocurrir en un subproceso separado programado después de que se ejecuta este código, pero no hay garantía de que Orden de ejecución del hilo, por lo que esto podría ser un problema. No es necesario borrar el client_id en este punto; simplemente elimine el código problemático.

20 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-20 16:15

Updated : 2025-11-17 17:03

NVD link : CVE-2025-37916

Mitre link : CVE-2025-37916

CVE.ORG link : CVE-2025-37916

JSON object : View

Products Affected

linux

CWE
CWE-416

Use After Free