CVE-2025-37949

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37949", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.972Z", "datePublished": "2025-05-20T16:01:45.242Z", "dateUpdated": "2026-10-15T21:52:04.919Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:34.906Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxenbus: Use kref to track req lifetime\n\nMarek reported seeing a NULL pointer fault in the xenbus_thread\ncallstack:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: e030:__wake_up_common+0x4c/0x180\nCall Trace:\n <TASK>\n __wake_up_common_lock+0x82/0xd0\n process_msg+0x18e/0x2f0\n xenbus_thread+0x165/0x1c0\n\nprocess_msg+0x18e is req->cb(req). req->cb is set to xs_wake_up(), a\nthin wrapper around wake_up(), or xenbus_dev_queue_reply(). It seems\nlike it was xs_wake_up() in this case.\n\nIt seems like req may have woken up the xs_wait_for_reply(), which\nkfree()ed the req. When xenbus_thread resumes, it faults on the zero-ed\ndata.\n\nLinux Device Drivers 2nd edition states:\n\"Normally, a wake_up call can cause an immediate reschedule to happen,\nmeaning that other processes might run before wake_up returns.\"\n... which would match the behaviour observed.\n\nChange to keeping two krefs on each request. One for the caller, and\none for xenbus_thread. Each will kref_put() when finished, and the last\nwill free it.\n\nThis use of kref matches the description in\nDocumentation/core-api/kref.rst"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The race is between the in-guest `xenbus_thread` and a local task blocked in `read_reply()`; it is driven by local writes to the `/dev/xen/xenbus` (or `/proc/xen/xenbus`) character device or by local sysfs/kernel-initiated xenstore requests. No network protocol handling is involved, so this requires local access to the Xen guest or dom0.\nAC:L - The attacker controls both sides of the race \u2014 their own thread is the waiter that performs the `kfree()`, and they issue the requests that cause `xenbus_thread` to call `wake_up()` \u2014 so they can retry unbounded, pin the racing threads to separate CPUs, and add scheduler load to widen the window. The bug is known to fire spontaneously during ordinary operation, confirming no attacker-uncontrollable precondition.\nPR:L - There is no `capable()` or credential check anywhere on the vulnerable path \u2014 unlike `xenbus_dev_backend.c` which gates on `CAP_SYS_ADMIN`, `xen_xenbus_fops` has none, so any user granted the xenbus device node can drive `XS_WATCH`/`XS_UNWATCH` into `xs_talkv()`; the world-readable `/sys/hypervisor/uuid` (mode 0444) also reaches `xenbus_read()` \u2192 `xs_talkv()`. A basic unprivileged local account suffices in realistic Xen deployments.\nUI:N - The attacker triggers the race entirely from their own thread pair by issuing xenstore requests and waiting for replies; no victim action, mount, or file open is required.\nS:U - The freed `xb_req_data` and the resulting corruption both live in the same kernel's slab, so the impact stays within the compromised guest's (or dom0's) security authority. No hypervisor, IOMMU, or VM boundary is crossed by the memory corruption itself.\nC:H - The use-after-free lets the attacker reallocate the freed `xb_req_data` with sprayed content that `__wake_up_common` then reads as a `wait_queue_entry` list, and the corrupted-object primitive is readily leveraged into arbitrary kernel memory disclosure. The object comes from a generic `kmalloc-128`/`kmalloc-192` cache shared with attacker-controllable allocations.\nI:H - `__wake_up_common` performs an indirect call `curr->func(curr, ...)` through a pointer read from the freed object, and `spin_unlock_irqrestore()` writes into the freed slot after reallocation \u2014 giving both control-flow hijack and a targeted write primitive, i.e. full kernel privilege escalation potential.\nA:H - The reported real-world symptom is a kernel NULL pointer dereference and oops in `__wake_up_common` from `xenbus_thread`, killing the xenstore transport thread and panicking the kernel. Any unsuccessful exploitation attempt likewise crashes the guest or dom0."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/xen/xenbus/xenbus.h", "drivers/xen/xenbus/xenbus_comms.c", "drivers/xen/xenbus/xenbus_dev_frontend.c", "drivers/xen/xenbus/xenbus_xs.c"], "versions": [{"version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "0e94a246bb6d9538010b6c02d2b1d4717a97b2e5", "status": "affected", "versionType": "git"}, {"version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "f1bcac367bc95631afbb918348f30dec887d0e1b", "status": "affected", "versionType": "git"}, {"version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "4d260a5558df4650eb87bc41b2c9ac2d6b2ba447", "status": "affected", "versionType": "git"}, {"version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "8b02f85e84dc6f7c150cef40ddb69af5a25659e5", "status": "affected", "versionType": "git"}, {"version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "cbfaf46b88a4c01b64c4186cdccd766c19ae644c", "status": "affected", "versionType": "git"}, {"version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "8e9c8a0393b5f85f1820c565ab8105660f4e8f92", "status": "affected", "versionType": "git"}, {"version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "2466b0f66795c3c426cacc8998499f38031dbb59", "status": "affected", "versionType": "git"}, {"version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/xen/xenbus/xenbus.h", "drivers/xen/xenbus/xenbus_comms.c", "drivers/xen/xenbus/xenbus_dev_frontend.c", "drivers/xen/xenbus/xenbus_xs.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.183", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.139", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.91", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.29", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.7", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.4.294"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.139"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.29"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.14.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0e94a246bb6d9538010b6c02d2b1d4717a97b2e5"}, {"url": "https://git.kernel.org/stable/c/f1bcac367bc95631afbb918348f30dec887d0e1b"}, {"url": "https://git.kernel.org/stable/c/4d260a5558df4650eb87bc41b2c9ac2d6b2ba447"}, {"url": "https://git.kernel.org/stable/c/8b02f85e84dc6f7c150cef40ddb69af5a25659e5"}, {"url": "https://git.kernel.org/stable/c/cbfaf46b88a4c01b64c4186cdccd766c19ae644c"}, {"url": "https://git.kernel.org/stable/c/8e9c8a0393b5f85f1820c565ab8105660f4e8f92"}, {"url": "https://git.kernel.org/stable/c/2466b0f66795c3c426cacc8998499f38031dbb59"}, {"url": "https://git.kernel.org/stable/c/1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27"}], "title": "xenbus: Use kref to track req lifetime", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:40.135Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37949", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:46:21.911402Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:04.919Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:40.135Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37949", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:46:21.911402Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:46:22.378Z"}}], "cna": {"title": "xenbus: Use kref to track req lifetime", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The race is between the in-guest `xenbus_thread` and a local task blocked in `read_reply()`; it is driven by local writes to the `/dev/xen/xenbus` (or `/proc/xen/xenbus`) character device or by local sysfs/kernel-initiated xenstore requests. No network protocol handling is involved, so this requires local access to the Xen guest or dom0.\nAC:L - The attacker controls both sides of the race \u2014 their own thread is the waiter that performs the `kfree()`, and they issue the requests that cause `xenbus_thread` to call `wake_up()` \u2014 so they can retry unbounded, pin the racing threads to separate CPUs, and add scheduler load to widen the window. The bug is known to fire spontaneously during ordinary operation, confirming no attacker-uncontrollable precondition.\nPR:L - There is no `capable()` or credential check anywhere on the vulnerable path \u2014 unlike `xenbus_dev_backend.c` which gates on `CAP_SYS_ADMIN`, `xen_xenbus_fops` has none, so any user granted the xenbus device node can drive `XS_WATCH`/`XS_UNWATCH` into `xs_talkv()`; the world-readable `/sys/hypervisor/uuid` (mode 0444) also reaches `xenbus_read()` \u2192 `xs_talkv()`. A basic unprivileged local account suffices in realistic Xen deployments.\nUI:N - The attacker triggers the race entirely from their own thread pair by issuing xenstore requests and waiting for replies; no victim action, mount, or file open is required.\nS:U - The freed `xb_req_data` and the resulting corruption both live in the same kernel's slab, so the impact stays within the compromised guest's (or dom0's) security authority. No hypervisor, IOMMU, or VM boundary is crossed by the memory corruption itself.\nC:H - The use-after-free lets the attacker reallocate the freed `xb_req_data` with sprayed content that `__wake_up_common` then reads as a `wait_queue_entry` list, and the corrupted-object primitive is readily leveraged into arbitrary kernel memory disclosure. The object comes from a generic `kmalloc-128`/`kmalloc-192` cache shared with attacker-controllable allocations.\nI:H - `__wake_up_common` performs an indirect call `curr->func(curr, ...)` through a pointer read from the freed object, and `spin_unlock_irqrestore()` writes into the freed slot after reallocation \u2014 giving both control-flow hijack and a targeted write primitive, i.e. full kernel privilege escalation potential.\nA:H - The reported real-world symptom is a kernel NULL pointer dereference and oops in `__wake_up_common` from `xenbus_thread`, killing the xenstore transport thread and panicking the kernel. Any unsuccessful exploitation attempt likewise crashes the guest or dom0."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "0e94a246bb6d9538010b6c02d2b1d4717a97b2e5", "versionType": "git"}, {"status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "f1bcac367bc95631afbb918348f30dec887d0e1b", "versionType": "git"}, {"status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "4d260a5558df4650eb87bc41b2c9ac2d6b2ba447", "versionType": "git"}, {"status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "8b02f85e84dc6f7c150cef40ddb69af5a25659e5", "versionType": "git"}, {"status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "cbfaf46b88a4c01b64c4186cdccd766c19ae644c", "versionType": "git"}, {"status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "8e9c8a0393b5f85f1820c565ab8105660f4e8f92", "versionType": "git"}, {"status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "2466b0f66795c3c426cacc8998499f38031dbb59", "versionType": "git"}, {"status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "lessThan": "1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27", "versionType": "git"}], "programFiles": ["drivers/xen/xenbus/xenbus.h", "drivers/xen/xenbus/xenbus_comms.c", "drivers/xen/xenbus/xenbus_dev_frontend.c", "drivers/xen/xenbus/xenbus_xs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"status": "unaffected", "version": "0", "lessThan": "4.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.294", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.238", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.183", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.139", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.91", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.29", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.7", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/xen/xenbus/xenbus.h", "drivers/xen/xenbus/xenbus_comms.c", "drivers/xen/xenbus/xenbus_dev_frontend.c", "drivers/xen/xenbus/xenbus_xs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0e94a246bb6d9538010b6c02d2b1d4717a97b2e5"}, {"url": "https://git.kernel.org/stable/c/f1bcac367bc95631afbb918348f30dec887d0e1b"}, {"url": "https://git.kernel.org/stable/c/4d260a5558df4650eb87bc41b2c9ac2d6b2ba447"}, {"url": "https://git.kernel.org/stable/c/8b02f85e84dc6f7c150cef40ddb69af5a25659e5"}, {"url": "https://git.kernel.org/stable/c/cbfaf46b88a4c01b64c4186cdccd766c19ae644c"}, {"url": "https://git.kernel.org/stable/c/8e9c8a0393b5f85f1820c565ab8105660f4e8f92"}, {"url": "https://git.kernel.org/stable/c/2466b0f66795c3c426cacc8998499f38031dbb59"}, {"url": "https://git.kernel.org/stable/c/1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxenbus: Use kref to track req lifetime\n\nMarek reported seeing a NULL pointer fault in the xenbus_thread\ncallstack:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: e030:__wake_up_common+0x4c/0x180\nCall Trace:\n <TASK>\n __wake_up_common_lock+0x82/0xd0\n process_msg+0x18e/0x2f0\n xenbus_thread+0x165/0x1c0\n\nprocess_msg+0x18e is req->cb(req). req->cb is set to xs_wake_up(), a\nthin wrapper around wake_up(), or xenbus_dev_queue_reply(). It seems\nlike it was xs_wake_up() in this case.\n\nIt seems like req may have woken up the xs_wait_for_reply(), which\nkfree()ed the req. When xenbus_thread resumes, it faults on the zero-ed\ndata.\n\nLinux Device Drivers 2nd edition states:\n\"Normally, a wake_up call can cause an immediate reschedule to happen,\nmeaning that other processes might run before wake_up returns.\"\n... which would match the behaviour observed.\n\nChange to keeping two krefs on each request. One for the caller, and\none for xenbus_thread. Each will kref_put() when finished, and the last\nwill free it.\n\nThis use of kref matches the description in\nDocumentation/core-api/kref.rst"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.294", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.238", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.183", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.139", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.91", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.29", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.7", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "4.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:34.906Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37949", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:04.919Z", "dateReserved": "2025-04-16T04:51:23.972Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-05-20T16:01:45.242Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/xen/xenbus/xenbus.h", "drivers/xen/xenbus/xenbus_comms.c", "drivers/xen/xenbus/xenbus_dev_frontend.c", "drivers/xen/xenbus/xenbus_xs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0e94a246bb6d9538010b6c02d2b1d4717a97b2e5", "status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "versionType": "git"}, {"lessThan": "f1bcac367bc95631afbb918348f30dec887d0e1b", "status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "versionType": "git"}, {"lessThan": "4d260a5558df4650eb87bc41b2c9ac2d6b2ba447", "status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "versionType": "git"}, {"lessThan": "8b02f85e84dc6f7c150cef40ddb69af5a25659e5", "status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "versionType": "git"}, {"lessThan": "cbfaf46b88a4c01b64c4186cdccd766c19ae644c", "status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "versionType": "git"}, {"lessThan": "8e9c8a0393b5f85f1820c565ab8105660f4e8f92", "status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "versionType": "git"}, {"lessThan": "2466b0f66795c3c426cacc8998499f38031dbb59", "status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "versionType": "git"}, {"lessThan": "1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27", "status": "affected", "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/xen/xenbus/xenbus.h", "drivers/xen/xenbus/xenbus_comms.c", "drivers/xen/xenbus/xenbus_dev_frontend.c", "drivers/xen/xenbus/xenbus_xs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.294", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.238", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.183", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.139", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.91", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.29", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "52FE04D3-53CF-427A-9E0F-9F05797D36D3", "versionEndExcluding": "5.4.294", "versionStartIncluding": "4.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DAAEF7F-D560-47FC-8B65-20404DB82432", "versionEndExcluding": "5.10.238", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "94D91ED4-346E-41EE-ACF5-F184C0A863D5", "versionEndExcluding": "5.15.183", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "70A2F216-574B-4B80-86BC-988928D5B83D", "versionEndExcluding": "6.1.139", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6826C73-C5C9-430D-84C9-4045DFD72074", "versionEndExcluding": "6.6.91", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7215ABCF-8EB1-46CD-8872-8BCE4890E579", "versionEndExcluding": "6.12.29", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5715A6F5-A34A-4B27-8A64-82825E963995", "versionEndExcluding": "6.14.7", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*", "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxenbus: Use kref to track req lifetime\n\nMarek reported seeing a NULL pointer fault in the xenbus_thread\ncallstack:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: e030:__wake_up_common+0x4c/0x180\nCall Trace:\n <TASK>\n __wake_up_common_lock+0x82/0xd0\n process_msg+0x18e/0x2f0\n xenbus_thread+0x165/0x1c0\n\nprocess_msg+0x18e is req->cb(req). req->cb is set to xs_wake_up(), a\nthin wrapper around wake_up(), or xenbus_dev_queue_reply(). It seems\nlike it was xs_wake_up() in this case.\n\nIt seems like req may have woken up the xs_wait_for_reply(), which\nkfree()ed the req. When xenbus_thread resumes, it faults on the zero-ed\ndata.\n\nLinux Device Drivers 2nd edition states:\n\"Normally, a wake_up call can cause an immediate reschedule to happen,\nmeaning that other processes might run before wake_up returns.\"\n... which would match the behaviour observed.\n\nChange to keeping two krefs on each request. One for the caller, and\none for xenbus_thread. Each will kref_put() when finished, and the last\nwill free it.\n\nThis use of kref matches the description in\nDocumentation/core-api/kref.rst"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xenbus: Usar kref para rastrear el tiempo de vida de req. Marek inform\u00f3 haber visto un fallo de puntero nulo en la pila de llamadas xenbus_thread: ERROR: desreferencia de puntero nulo del kernel, direcci\u00f3n: 0000000000000000 RIP: e030:__wake_up_common+0x4c/0x180 Rastreo de llamadas: __wake_up_common_lock+0x82/0xd0 process_msg+0x18e/0x2f0 xenbus_thread+0x165/0x1c0 process_msg+0x18e es req-&gt;cb(req). req-&gt;cb est\u00e1 configurado como xs_wake_up(), una envoltura ligera alrededor de wake_up(), o xenbus_dev_queue_reply(). Parece que en este caso era xs_wake_up(). Parece que req pudo haber despertado xs_wait_for_reply(), que liber\u00f3 la solicitud. Cuando xenbus_thread se reanuda, falla en los datos con ceros. La segunda edici\u00f3n de los controladores de dispositivos de Linux indica: \u00abNormalmente, una llamada wake_up puede provocar una reprogramaci\u00f3n inmediata, lo que significa que otros procesos podr\u00edan ejecutarse antes de que wake_up regrese\u00bb. ... lo cual coincidir\u00eda con el comportamiento observado. Se recomienda mantener dos krefs en cada solicitud: uno para el que realiza la llamada y otro para xenbus_thread. Cada uno ejecutar\u00e1 kref_put() al finalizar, y el \u00faltimo lo liberar\u00e1. Este uso de kref coincide con la descripci\u00f3n en Documentation/core-api/kref.rst."}], "id": "CVE-2025-37949", "lastModified": "2026-10-15T22:18:22.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37949", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:46:21.911402Z", "version": "2.0.3"}}]}, "published": "2025-05-20T16:15:32.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e94a246bb6d9538010b6c02d2b1d4717a97b2e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2466b0f66795c3c426cacc8998499f38031dbb59"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4d260a5558df4650eb87bc41b2c9ac2d6b2ba447"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8b02f85e84dc6f7c150cef40ddb69af5a25659e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e9c8a0393b5f85f1820c565ab8105660f4e8f92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cbfaf46b88a4c01b64c4186cdccd766c19ae644c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f1bcac367bc95631afbb918348f30dec887d0e1b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: xenbus: Use kref to track req lifetime", "id": "2367590", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2367590"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxenbus: Use kref to track req lifetime\nMarek reported seeing a NULL pointer fault in the xenbus_thread\ncallstack:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: e030:__wake_up_common+0x4c/0x180\nCall Trace:\n<TASK>\n__wake_up_common_lock+0x82/0xd0\nprocess_msg+0x18e/0x2f0\nxenbus_thread+0x165/0x1c0\nprocess_msg+0x18e is req->cb(req). req->cb is set to xs_wake_up(), a\nthin wrapper around wake_up(), or xenbus_dev_queue_reply(). It seems\nlike it was xs_wake_up() in this case.\nIt seems like req may have woken up the xs_wait_for_reply(), which\nkfree()ed the req. When xenbus_thread resumes, it faults on the zero-ed\ndata.\nLinux Device Drivers 2nd edition states:\n\"Normally, a wake_up call can cause an immediate reschedule to happen,\nmeaning that other processes might run before wake_up returns.\"\n... which would match the behaviour observed.\nChange to keeping two krefs on each request. One for the caller, and\none for xenbus_thread. Each will kref_put() when finished, and the last\nwill free it.\nThis use of kref matches the description in\nDocumentation/core-api/kref.rst"], "name": "CVE-2025-37949", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37949\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37949\nhttps://lore.kernel.org/linux-cve-announce/2025052000-CVE-2025-37949-c272@gregkh/T"], "statement": "Local issue in Xen guest kernel requiring privileged access. No remote vector or privilege escalation; only potential DoS via NULL dereference.", "threat_severity": "Moderate"}

{"created": "2025-06-27T09:26:50.391823+00:00", "updated": "2025-06-27T09:26:50.391873+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}