CVE-2025-37916 (GCVE-0-2025-37916)
Vulnerability from cvelistv5
Published
2025-05-20 15:21
Modified
2025-05-26 05:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: pds_core: remove write-after-free of client_id A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47): [Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0x70 [Mon Apr 21 21:21:33 2025] device_release_driver_internal+0x11f/0x180 [Mon Apr 21 21:21:33 2025] driver_detach+0x45/0x80 [Mon Apr 21 21:21:33 2025] bus_remove_driver+0x83/0xe0 [Mon Apr 21 21:21:33 2025] pci_unregister_driver+0x1a/0x80 The actual device uninit usually happens on a separate thread scheduled after this code runs, but there is no guarantee of order of thread execution, so this could be a problem. There's no actual need to clear the client_id at this point, so simply remove the offending code.
References
Impacted products
Vendor Product Version
Linux Linux Version: 10659034c622738bc1bfab8a76fc576c52d5acce
Version: 10659034c622738bc1bfab8a76fc576c52d5acce
Version: 10659034c622738bc1bfab8a76fc576c52d5acce
Version: 10659034c622738bc1bfab8a76fc576c52d5acce
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/auxbus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b",
              "status": "affected",
              "version": "10659034c622738bc1bfab8a76fc576c52d5acce",
              "versionType": "git"
            },
            {
              "lessThan": "c649b9653ed09196e91d3f4b16b679041b3c42e6",
              "status": "affected",
              "version": "10659034c622738bc1bfab8a76fc576c52d5acce",
              "versionType": "git"
            },
            {
              "lessThan": "26dc701021302f11c8350108321d11763bd81dfe",
              "status": "affected",
              "version": "10659034c622738bc1bfab8a76fc576c52d5acce",
              "versionType": "git"
            },
            {
              "lessThan": "dfd76010f8e821b66116dec3c7d90dd2403d1396",
              "status": "affected",
              "version": "10659034c622738bc1bfab8a76fc576c52d5acce",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/auxbus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: remove write-after-free of client_id\n\nA use-after-free error popped up in stress testing:\n\n[Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core]\n[Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47):\n[Mon Apr 21 21:21:33 2025]  pdsc_auxbus_dev_del+0xef/0x160 [pds_core]\n[Mon Apr 21 21:21:33 2025]  pdsc_remove+0xc0/0x1b0 [pds_core]\n[Mon Apr 21 21:21:33 2025]  pci_device_remove+0x24/0x70\n[Mon Apr 21 21:21:33 2025]  device_release_driver_internal+0x11f/0x180\n[Mon Apr 21 21:21:33 2025]  driver_detach+0x45/0x80\n[Mon Apr 21 21:21:33 2025]  bus_remove_driver+0x83/0xe0\n[Mon Apr 21 21:21:33 2025]  pci_unregister_driver+0x1a/0x80\n\nThe actual device uninit usually happens on a separate thread\nscheduled after this code runs, but there is no guarantee of order\nof thread execution, so this could be a problem.  There\u0027s no\nactual need to clear the client_id at this point, so simply\nremove the offending code."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:23:38.953Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c649b9653ed09196e91d3f4b16b679041b3c42e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/26dc701021302f11c8350108321d11763bd81dfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfd76010f8e821b66116dec3c7d90dd2403d1396"
        }
      ],
      "title": "pds_core: remove write-after-free of client_id",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37916",
    "datePublished": "2025-05-20T15:21:47.088Z",
    "dateReserved": "2025-04-16T04:51:23.967Z",
    "dateUpdated": "2025-05-26T05:23:38.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37916\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:28.170\",\"lastModified\":\"2025-05-21T20:25:16.407\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npds_core: remove write-after-free of client_id\\n\\nA use-after-free error popped up in stress testing:\\n\\n[Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core]\\n[Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47):\\n[Mon Apr 21 21:21:33 2025]  pdsc_auxbus_dev_del+0xef/0x160 [pds_core]\\n[Mon Apr 21 21:21:33 2025]  pdsc_remove+0xc0/0x1b0 [pds_core]\\n[Mon Apr 21 21:21:33 2025]  pci_device_remove+0x24/0x70\\n[Mon Apr 21 21:21:33 2025]  device_release_driver_internal+0x11f/0x180\\n[Mon Apr 21 21:21:33 2025]  driver_detach+0x45/0x80\\n[Mon Apr 21 21:21:33 2025]  bus_remove_driver+0x83/0xe0\\n[Mon Apr 21 21:21:33 2025]  pci_unregister_driver+0x1a/0x80\\n\\nThe actual device uninit usually happens on a separate thread\\nscheduled after this code runs, but there is no guarantee of order\\nof thread execution, so this could be a problem.  There\u0027s no\\nactual need to clear the client_id at this point, so simply\\nremove the offending code.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pds_core: eliminar escritura use-after-free de client_id Apareci\u00f3 un error de use-after-free en las pruebas de estr\u00e9s: [Lun 21 Abr 21:21:33 2025] ERROR: KFENCE: escritura use-after-free en pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Lun 21 Abr 21:21:33 2025] Escritura use-after-free en 0x000000007013ecd1 (en kfence-#47): [Lun 21 Abr 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Lun 21 Abr 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Lun 21 Abr 21:21:33 2025] pci_device_remove+0x24/0x70 [Lun 21 Abr 21:21:33 2025] device_release_driver_internal+0x11f/0x180 [Lun 21 Abr 21:21:33 2025] driver_detach+0x45/0x80 [Lun 21 Abr 21:21:33 2025] bus_remove_driver+0x83/0xe0 [Lun 21 Abr 21:21:33 2025] pci_unregister_driver+0x1a/0x80 La desinicializaci\u00f3n real del dispositivo suele ocurrir en un subproceso separado programado despu\u00e9s de que se ejecuta este c\u00f3digo, pero no hay garant\u00eda de que Orden de ejecuci\u00f3n del hilo, por lo que esto podr\u00eda ser un problema. No es necesario borrar el client_id en este punto; simplemente elimine el c\u00f3digo problem\u00e1tico.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/26dc701021302f11c8350108321d11763bd81dfe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c649b9653ed09196e91d3f4b16b679041b3c42e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dfd76010f8e821b66116dec3c7d90dd2403d1396\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.