CVE-2025-37820

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37820", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.947Z", "datePublished": "2025-05-08T06:26:14.602Z", "dateUpdated": "2026-10-15T21:52:00.774Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:44.618Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: handle NULL returned by xdp_convert_buff_to_frame()\n\nThe function xdp_convert_buff_to_frame() may return NULL if it fails\nto correctly convert the XDP buffer into an XDP frame due to memory\nconstraints, internal errors, or invalid data. Failing to check for NULL\nmay lead to a NULL pointer dereference if the result is used later in\nprocessing, potentially causing crashes, data corruption, or undefined\nbehavior.\n\nOn XDP redirect failure, the associated page must be released explicitly\nif it was previously retained via get_page(). Failing to do so may result\nin a memory leak, as the pages reference count is not decremented."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is the xen-netfront NAPI receive path processing frames delivered from the network, and the triggering condition (slot length > 3264 bytes) is determined directly by the size of the frame the remote peer sends. Consistent with kernel CNA scoring of other driver XDP RX-path crashes (CVE-2026-53069, CVE-2026-53229), this is remotely reachable.\nAC:L - The attacker fully controls the packet size that drives `xdp_convert_buff_to_frame()` to fail, and can repeat it at will with no race, no memory-layout dependency, and no reliance on any state outside their control.\nPR:N - No credentials or account on the target are needed \u2014 an unauthenticated remote sender reaching the guest's network interface is sufficient, and a malicious Xen backend can trigger it with no guest privileges at all.\nUI:N - The crash occurs entirely within softirq packet processing on frame receipt; no victim action is required.\nS:U - The NULL dereference happens in the guest kernel that also owns the vulnerable driver, so the impacted component and the vulnerable component share the same security authority; no hypervisor, IOMMU, or VM boundary is crossed.\nC:N - The defect is a NULL pointer dereference plus a page reference-count leak \u2014 neither yields an out-of-bounds read, freed-object reuse, or any disclosure of kernel memory to the attacker.\nI:N - No attacker-controlled write occurs; the refcount is only incremented (leaked, never underflowed), so there is no memory corruption or control-flow hijack primitive.\nA:H - `xdp_return_frame_rx_napi(NULL)` dereferences NULL inside NAPI/softirq context, producing an oops that is fatal in interrupt context (full kernel panic), and it can be re-triggered with every oversized frame."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netfront.c"], "versions": [{"version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "5b83d30c63f9964acb1bc63eb8e670b9e0d2c240", "status": "affected", "versionType": "git"}, {"version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa", "status": "affected", "versionType": "git"}, {"version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9", "status": "affected", "versionType": "git"}, {"version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "eefccd889df3b49d92e7349d94c4aa7e1ba19f6c", "status": "affected", "versionType": "git"}, {"version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "cc3628dcd851ddd8d418bf0c897024b4621ddc92", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/xen-netfront.c"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.136", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.89", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.5", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.1.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.6.89"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.12.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.14.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5b83d30c63f9964acb1bc63eb8e670b9e0d2c240"}, {"url": "https://git.kernel.org/stable/c/cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa"}, {"url": "https://git.kernel.org/stable/c/d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9"}, {"url": "https://git.kernel.org/stable/c/eefccd889df3b49d92e7349d94c4aa7e1ba19f6c"}, {"url": "https://git.kernel.org/stable/c/cc3628dcd851ddd8d418bf0c897024b4621ddc92"}], "title": "xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:55:53.465Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37820", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:24.118480Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:00.774Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:55:53.465Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37820", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:24.118480Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:45:24.883Z"}}], "cna": {"title": "xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is the xen-netfront NAPI receive path processing frames delivered from the network, and the triggering condition (slot length > 3264 bytes) is determined directly by the size of the frame the remote peer sends. Consistent with kernel CNA scoring of other driver XDP RX-path crashes (CVE-2026-53069, CVE-2026-53229), this is remotely reachable.\nAC:L - The attacker fully controls the packet size that drives `xdp_convert_buff_to_frame()` to fail, and can repeat it at will with no race, no memory-layout dependency, and no reliance on any state outside their control.\nPR:N - No credentials or account on the target are needed \u2014 an unauthenticated remote sender reaching the guest's network interface is sufficient, and a malicious Xen backend can trigger it with no guest privileges at all.\nUI:N - The crash occurs entirely within softirq packet processing on frame receipt; no victim action is required.\nS:U - The NULL dereference happens in the guest kernel that also owns the vulnerable driver, so the impacted component and the vulnerable component share the same security authority; no hypervisor, IOMMU, or VM boundary is crossed.\nC:N - The defect is a NULL pointer dereference plus a page reference-count leak \u2014 neither yields an out-of-bounds read, freed-object reuse, or any disclosure of kernel memory to the attacker.\nI:N - No attacker-controlled write occurs; the refcount is only incremented (leaked, never underflowed), so there is no memory corruption or control-flow hijack primitive.\nA:H - `xdp_return_frame_rx_napi(NULL)` dereferences NULL inside NAPI/softirq context, producing an oops that is fatal in interrupt context (full kernel panic), and it can be re-triggered with every oversized frame."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "5b83d30c63f9964acb1bc63eb8e670b9e0d2c240", "versionType": "git"}, {"status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa", "versionType": "git"}, {"status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9", "versionType": "git"}, {"status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "eefccd889df3b49d92e7349d94c4aa7e1ba19f6c", "versionType": "git"}, {"status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "cc3628dcd851ddd8d418bf0c897024b4621ddc92", "versionType": "git"}], "programFiles": ["drivers/net/xen-netfront.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"status": "unaffected", "version": "0", "lessThan": "5.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.136", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.89", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.26", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.5", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/xen-netfront.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5b83d30c63f9964acb1bc63eb8e670b9e0d2c240"}, {"url": "https://git.kernel.org/stable/c/cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa"}, {"url": "https://git.kernel.org/stable/c/d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9"}, {"url": "https://git.kernel.org/stable/c/eefccd889df3b49d92e7349d94c4aa7e1ba19f6c"}, {"url": "https://git.kernel.org/stable/c/cc3628dcd851ddd8d418bf0c897024b4621ddc92"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: handle NULL returned by xdp_convert_buff_to_frame()\n\nThe function xdp_convert_buff_to_frame() may return NULL if it fails\nto correctly convert the XDP buffer into an XDP frame due to memory\nconstraints, internal errors, or invalid data. Failing to check for NULL\nmay lead to a NULL pointer dereference if the result is used later in\nprocessing, potentially causing crashes, data corruption, or undefined\nbehavior.\n\nOn XDP redirect failure, the associated page must be released explicitly\nif it was previously retained via get_page(). Failing to do so may result\nin a memory leak, as the pages reference count is not decremented."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.136", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.89", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.26", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.5", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "5.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:44.618Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37820", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:00.774Z", "dateReserved": "2025-04-16T04:51:23.947Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-05-08T06:26:14.602Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/xen-netfront.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5b83d30c63f9964acb1bc63eb8e670b9e0d2c240", "status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "versionType": "git"}, {"lessThan": "cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa", "status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "versionType": "git"}, {"lessThan": "d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9", "status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "versionType": "git"}, {"lessThan": "eefccd889df3b49d92e7349d94c4aa7e1ba19f6c", "status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "versionType": "git"}, {"lessThan": "cc3628dcd851ddd8d418bf0c897024b4621ddc92", "status": "affected", "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/xen-netfront.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"lessThan": "5.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.136", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.89", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.26", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D67E8AB4-7D3B-4FC3-8ED9-A08CC35D98CB", "versionEndExcluding": "6.1.136", "versionStartIncluding": "5.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D79CE030-3114-45E0-B52B-C77781BCB587", "versionEndExcluding": "6.6.89", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "22F52099-F422-4D19-8283-45F9F9BF4392", "versionEndExcluding": "6.12.26", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B25CA7E-4CD0-46DB-B4EF-13A3516071FB", "versionEndExcluding": "6.14.5", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: handle NULL returned by xdp_convert_buff_to_frame()\n\nThe function xdp_convert_buff_to_frame() may return NULL if it fails\nto correctly convert the XDP buffer into an XDP frame due to memory\nconstraints, internal errors, or invalid data. Failing to check for NULL\nmay lead to a NULL pointer dereference if the result is used later in\nprocessing, potentially causing crashes, data corruption, or undefined\nbehavior.\n\nOn XDP redirect failure, the associated page must be released explicitly\nif it was previously retained via get_page(). Failing to do so may result\nin a memory leak, as the pages reference count is not decremented."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xen-netfront: manejador NULL devuelto por xdp_convert_buff_to_frame(). La funci\u00f3n xdp_convert_buff_to_frame() puede devolver NULL si no convierte correctamente el b\u00fafer XDP en un marco XDP debido a limitaciones de memoria, errores internos o datos no v\u00e1lidos. No comprobar si hay NULL puede provocar una desreferencia de puntero NULL si el resultado se utiliza m\u00e1s adelante en el procesamiento, lo que puede causar fallos, corrupci\u00f3n de datos o un comportamiento indefinido. En caso de fallo en la redirecci\u00f3n XDP, la p\u00e1gina asociada debe liberarse expl\u00edcitamente si se retuvo previamente mediante get_page(). No hacerlo puede provocar una fuga de memoria, ya que el recuento de referencias de p\u00e1ginas no se reduce."}], "id": "CVE-2025-37820", "lastModified": "2026-10-15T22:18:18.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37820", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:45:24.118480Z", "version": "2.0.3"}}]}, "published": "2025-05-08T07:15:53.237", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5b83d30c63f9964acb1bc63eb8e670b9e0d2c240"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc3628dcd851ddd8d418bf0c897024b4621ddc92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eefccd889df3b49d92e7349d94c4aa7e1ba19f6c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()", "id": "2365023", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365023"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxen-netfront: handle NULL returned by xdp_convert_buff_to_frame()\nThe function xdp_convert_buff_to_frame() may return NULL if it fails\nto correctly convert the XDP buffer into an XDP frame due to memory\nconstraints, internal errors, or invalid data. Failing to check for NULL\nmay lead to a NULL pointer dereference if the result is used later in\nprocessing, potentially causing crashes, data corruption, or undefined\nbehavior.\nOn XDP redirect failure, the associated page must be released explicitly\nif it was previously retained via get_page(). Failing to do so may result\nin a memory leak, as the pages reference count is not decremented."], "name": "CVE-2025-37820", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37820\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37820\nhttps://lore.kernel.org/linux-cve-announce/2025050820-CVE-2025-37820-799c@gregkh/T"], "threat_severity": "Moderate"}

{}