CVE-2025-37960

MEDIUM EPSS 4.4%
Published May 20, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published May 20, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: memblock: Accept allocated memory before use in memblock_double_array() When increasing the array size in memblock_double_array() and the slab is not yet available, a call to memblock_find_in_range() is used to reserve/allocate memory. However, the range returned may not have been accepted, which can result in a crash when booting an SNP guest: RIP: 0010:memcpy_orig+0x68/0x130 Code: ... RSP: 0000:ffffffff9cc03ce8 EFLAGS: 00010006 RAX: ff11001ff83e5000 RBX: 0000000000000000 RCX: fffffffffffff000 RDX: 0000000000000bc0 RSI: ffffffff9dba8860 RDI: ff11001ff83e5c00 RBP: 0000000000002000 R08: 0000000000000000 R09: 0000000000002000 R10: 000000207fffe000 R11: 0000040000000000 R12: ffffffff9d06ef78 R13: ff11001ff83e5000 R14: ffffffff9dba7c60 R15: 0000000000000c00 memblock_double_array+0xff/0x310 memblock_add_range+0x1fb/0x2f0 memblock_reserve+0x4f/0xa0 memblock_alloc_range_nid+0xac/0x130 memblock_alloc_internal+0x53/0xc0 memblock_alloc_try_nid+0x3d/0xa0 swiotlb_init_remap+0x149/0x2f0 mem_init+0xb/0xb0 mm_core_init+0x8f/0x350 start_kernel+0x17e/0x5d0 x86_64_start_reservations+0x14/0x30 x86_64_start_kernel+0x92/0xa0 secondary_startup_64_no_verify+0x194/0x19b Mitigate this by calling accept_memory() on the memory range returned before the slab is available. Prior to v6.12, the accept_memory() interface used a 'start' and 'end' parameter instead of 'start' and 'size', therefore the accept_memory() call must be adjusted to specify 'start + size' for 'end' when applying to kernels prior to v6.12.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
4.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 8

VendorProductVersionRange
linuxlinux_kernel*≥6.5  –  <6.6.92
linuxlinux_kernel*≥6.7  –  <6.12.29
linuxlinux_kernel*≥6.13  –  <6.14.7
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any
linuxlinux_kernel6.15any

References 4

  • git.kernel.org https://git.kernel.org/stable/c/7bcd29181bab8d508d2adfdbb132de8b1e088698
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/aa513e69e011a2b19fa22ce62ce35effbd5e0c81
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d66a22f6a432a9dd376c9b365d7dc89bd416909c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/da8bf5daa5e55a6af2b285ecda460d6454712ff4
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/7bcd29181bab8d508d2adfdbb132de8b1e088698
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/aa513e69e011a2b19fa22ce62ce35effbd5e0c81
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d66a22f6a432a9dd376c9b365d7dc89bd416909c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/da8bf5daa5e55a6af2b285ecda460d6454712ff4
    Patch