CVE-2025-37886

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37886", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.963Z", "datePublished": "2025-05-09T06:45:48.810Z", "dateUpdated": "2026-08-05T11:58:03.678Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:03.678Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: make wait_context part of q_info\n\nMake the wait_context a full part of the q_info struct rather\nthan a stack variable that goes away after pdsc_adminq_post()\nis done so that the context is still available after the wait\nloop has given up.\n\nThere was a case where a slow development firmware caused\nthe adminq request to time out, but then later the FW finally\nfinished the request and sent the interrupt. The handler tried\nto complete_all() the completion context that had been created\non the stack in pdsc_adminq_post() but no longer existed.\nThis caused bad pointer usage, kernel crashes, and much wailing\nand gnashing of teeth."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The AdminQ is a host control-plane queue with no packet-driven path; reaching it requires local access to a device handle \u2014 `/dev/fwctl/fwctlN` (`FWCTL_RPC`), a VFIO-assigned pds VF, or a vhost-vdpa node. No remote or adjacent-network actor can post AdminQ commands.\nAC:L - The attacker creates the required condition rather than waiting for it: fwctl RPCs let userspace choose arbitrary long-running firmware operations, and the 16-entry FW backing queue is trivially congested (documented in sibling commit d9e2f070d8af6) so commands exceed the 5s timeout while still completing later. Once the timeout fires there is no window to win \u2014 the stack frame is already dead and the attacker can groom it at leisure before the completion lands.\nPR:L - The fwctl `FWCTL_RPC_CONFIGURATION`/`DEBUG_READ_ONLY` scopes require no capability whatsoever (only file access to the char device), and VFIO/vhost-vdpa device nodes are routinely granted to unprivileged VMM and management users. No real root in the init namespace is needed.\nUI:N - The attacker posts the AdminQ command and the corruption occurs asynchronously from the driver's own workqueue when the firmware completes; no victim action is involved at any point.\nS:U - The stale-stack write and completion abuse occur entirely within the host kernel, the same security authority as the vulnerable driver. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:H - The dangling `q_info->dest` write places 16 bytes of firmware-supplied data into a reused kernel stack frame whose subsequent occupant the attacker chooses, and the stale-completion list walk yields arbitrary-pointer dereference primitives that can be leveraged for kernel memory disclosure.\nI:H - This is a 16-byte device-controlled write to a freed stack frame plus `complete_all()` on a stale `struct completion` \u2014 writing `UINT_MAX` and traversing/waking an swait list built from attacker-groomed stack bytes, which is an arbitrary-write and control-flow-hijack primitive.\nA:H - The fix commit explicitly reports \"bad pointer usage, kernel crashes\"; additionally, acquiring a raw spinlock at a stale stack address can hang the AdminQ workqueue indefinitely, and the condition is repeatable at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/adminq.c", "drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h"], "versions": [{"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381", "status": "affected", "versionType": "git"}, {"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "66d7702b42ffdf0dce4808626088268a4e905ca6", "status": "affected", "versionType": "git"}, {"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "520f012fe75fb8efc9f16a57ef929a7a2115d892", "status": "affected", "versionType": "git"}, {"version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "3f77c3dfffc7063428b100c4945ca2a7a8680380", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/adminq.c", "drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.89", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.5", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.89"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.14.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381"}, {"url": "https://git.kernel.org/stable/c/66d7702b42ffdf0dce4808626088268a4e905ca6"}, {"url": "https://git.kernel.org/stable/c/520f012fe75fb8efc9f16a57ef929a7a2115d892"}, {"url": "https://git.kernel.org/stable/c/3f77c3dfffc7063428b100c4945ca2a7a8680380"}], "title": "pds_core: make wait_context part of q_info", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amd/pds_core/adminq.c", "drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381", "status": "affected", "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "versionType": "git"}, {"lessThan": "66d7702b42ffdf0dce4808626088268a4e905ca6", "status": "affected", "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "versionType": "git"}, {"lessThan": "520f012fe75fb8efc9f16a57ef929a7a2115d892", "status": "affected", "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "versionType": "git"}, {"lessThan": "3f77c3dfffc7063428b100c4945ca2a7a8680380", "status": "affected", "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amd/pds_core/adminq.c", "drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.89", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.26", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "68140DF8-D867-4147-A1CD-E3630C9CE7A5", "versionEndExcluding": "6.6.89", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "22F52099-F422-4D19-8283-45F9F9BF4392", "versionEndExcluding": "6.12.26", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B25CA7E-4CD0-46DB-B4EF-13A3516071FB", "versionEndExcluding": "6.14.5", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: make wait_context part of q_info\n\nMake the wait_context a full part of the q_info struct rather\nthan a stack variable that goes away after pdsc_adminq_post()\nis done so that the context is still available after the wait\nloop has given up.\n\nThere was a case where a slow development firmware caused\nthe adminq request to time out, but then later the FW finally\nfinished the request and sent the interrupt. The handler tried\nto complete_all() the completion context that had been created\non the stack in pdsc_adminq_post() but no longer existed.\nThis caused bad pointer usage, kernel crashes, and much wailing\nand gnashing of teeth."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pds_core: hacer que wait_context forme parte de q_info Hacer que wait_context sea una parte completa de la estructura q_info en lugar de una variable de pila que desaparezca despu\u00e9s de que pdsc_adminq_post() se complete para que el contexto siga disponible despu\u00e9s de que el bucle de espera se haya dado por vencido. Hubo un caso en el que un firmware de desarrollo lento provoc\u00f3 que la solicitud adminq expirara, pero luego el FW finalmente termin\u00f3 la solicitud y envi\u00f3 la interrupci\u00f3n. El controlador intent\u00f3 completar_todo() el contexto de finalizaci\u00f3n que se hab\u00eda creado en la pila en pdsc_adminq_post() pero ya no exist\u00eda. Esto caus\u00f3 un mal uso del puntero, fallos del kernel y muchos lamentos y crujir de dientes."}], "id": "CVE-2025-37886", "lastModified": "2026-07-30T06:22:28.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-05-09T07:16:09.973", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3f77c3dfffc7063428b100c4945ca2a7a8680380"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/520f012fe75fb8efc9f16a57ef929a7a2115d892"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66d7702b42ffdf0dce4808626088268a4e905ca6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: pds_core: make wait_context part of q_info", "id": "2365274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365274"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\npds_core: make wait_context part of q_info\nMake the wait_context a full part of the q_info struct rather\nthan a stack variable that goes away after pdsc_adminq_post()\nis done so that the context is still available after the wait\nloop has given up.\nThere was a case where a slow development firmware caused\nthe adminq request to time out, but then later the FW finally\nfinished the request and sent the interrupt. The handler tried\nto complete_all() the completion context that had been created\non the stack in pdsc_adminq_post() but no longer existed.\nThis caused bad pointer usage, kernel crashes, and much wailing\nand gnashing of teeth."], "name": "CVE-2025-37886", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37886\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37886\nhttps://lore.kernel.org/linux-cve-announce/2025050945-CVE-2025-37886-cab3@gregkh/T"], "threat_severity": "Moderate"}

{}