CVE-2025-37996 (GCVE-0-2025-37996)

Vulnerability from cvelistv5 – Published: 2025-05-29 13:15 – Updated: 2026-08-05 11:58
VLAI
Title
KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort() Commit fce886a60207 ("KVM: arm64: Plumb the pKVM MMU in KVM") made the initialization of the local memcache variable in user_mem_abort() conditional, leaving a codepath where it is used uninitialized via kvm_pgtable_stage2_map(). This can fail on any path that requires a stage-2 allocation without transition via a permission fault or dirty logging. Fix this by making sure that memcache is always valid.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fce886a6020734d6253c2c5a3bc285e385cc5496 , < a26d50f8a4a5049e956984797b5d0dedea4bbb18 (git)
Affected: fce886a6020734d6253c2c5a3bc285e385cc5496 , < 157dbc4a321f5bb6f8b6c724d12ba720a90f1a7c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.14.7 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a26d50f8a4a5049e956984797b5d0dedea4bbb18",
              "status": "affected",
              "version": "fce886a6020734d6253c2c5a3bc285e385cc5496",
              "versionType": "git"
            },
            {
              "lessThan": "157dbc4a321f5bb6f8b6c724d12ba720a90f1a7c",
              "status": "affected",
              "version": "fce886a6020734d6253c2c5a3bc285e385cc5496",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.7",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()\n\nCommit fce886a60207 (\"KVM: arm64: Plumb the pKVM MMU in KVM\") made the\ninitialization of the local memcache variable in user_mem_abort()\nconditional, leaving a codepath where it is used uninitialized via\nkvm_pgtable_stage2_map().\n\nThis can fail on any path that requires a stage-2 allocation\nwithout transition via a permission fault or dirty logging.\n\nFix this by making sure that memcache is always valid."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the host kernel\u0027s stage-2 fault handler, reached through guest execution under KVM_RUN (or directly by a local user with /dev/kvm who builds their own VM); there is no network-facing path.\nAC:L - No race or unpredictable precondition is involved \u2014 an attacker controlling a guest can deterministically arrange a huge-block stage-2 mapping and then take a non-write permission fault (instruction fetch, or an NV shadow-S2 granule mismatch) so that `memcache` is consumed uninitialized on every attempt.\nPR:L - The attacker only needs code execution inside a guest VM, or unprivileged access to /dev/kvm on the host (commonly group- or world-accessible on Android, desktops and libvirt hosts); no host root is required.\nUI:N - The fault is raised by the guest\u0027s own memory access during normal vCPU execution, with no action needed from the host operator or any other user.\nS:C - The bug lets a guest corrupt host-kernel memory through the stage-2 page-table allocator, crossing from the VM\u0027s security authority into the hypervisor host \u2014 a guest-to-host boundary violation.\nC:H - `kvm_mmu_memory_cache_alloc()` performs `mc-\u003eobjects[--mc-\u003enobjs]` through the garbage pointer, an attacker-influenceable arbitrary read whose result is then mapped into the guest\u0027s stage-2 tables, exposing host memory contents to the guest.\nI:H - The uninitialized pointer yields wild writes (`--mc-\u003enobjs`, and under pKVM `swap(mapping, cache-\u003emapping)` followed by `mapping-\u003egfn/pfn` stores) and causes arbitrary host memory to be installed as a guest stage-2 page table with matching `get_page`/`put_page` refcount manipulation \u2014 a host memory-corruption and control-flow-hijack primitive.\nA:H - In the ordinary case the wild dereference (or the `BUG_ON(!p)` in `kvm_mmu_memory_cache_alloc()`) oopses in the vCPU thread while holding the KVM fault lock, panicking the host kernel and taking down every VM on the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:48.143Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a26d50f8a4a5049e956984797b5d0dedea4bbb18"
        },
        {
          "url": "https://git.kernel.org/stable/c/157dbc4a321f5bb6f8b6c724d12ba720a90f1a7c"
        }
      ],
      "title": "KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37996",
    "datePublished": "2025-05-29T13:15:54.956Z",
    "dateReserved": "2025-04-16T04:51:23.976Z",
    "dateUpdated": "2026-08-05T11:58:48.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37996",
      "date": "2026-09-15",
      "epss": "0.00157",
      "percentile": "0.0519"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37996\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-29T14:15:36.183\",\"lastModified\":\"2026-07-30T06:22:42.973\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()\\n\\nCommit fce886a60207 (\\\"KVM: arm64: Plumb the pKVM MMU in KVM\\\") made the\\ninitialization of the local memcache variable in user_mem_abort()\\nconditional, leaving a codepath where it is used uninitialized via\\nkvm_pgtable_stage2_map().\\n\\nThis can fail on any path that requires a stage-2 allocation\\nwithout transition via a permission fault or dirty logging.\\n\\nFix this by making sure that memcache is always valid.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: arm64: Correcci\u00f3n de un puntero de memcache no inicializado en user_mem_abort(). El commit fce886a60207 (\\\"KVM: arm64: Conectar la MMU pKVM en KVM\\\") hizo que la inicializaci\u00f3n de la variable de memcache local en user_mem_abort() fuera condicional, dejando la ruta de c\u00f3digo donde se usa sin inicializar mediante kvm_pgtable_stage2_map(). Esto puede fallar en cualquier ruta que requiera una asignaci\u00f3n de etapa 2 sin transici\u00f3n debido a un fallo de permiso o un registro incorrecto. Para solucionar esto, aseg\u00farese de que la memcache sea siempre v\u00e1lida.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/kvm/mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fce886a6020734d6253c2c5a3bc285e385cc5496\",\"lessThan\":\"a26d50f8a4a5049e956984797b5d0dedea4bbb18\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fce886a6020734d6253c2c5a3bc285e385cc5496\",\"lessThan\":\"157dbc4a321f5bb6f8b6c724d12ba720a90f1a7c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/kvm/mmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.7\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.7\",\"matchCriteriaId\":\"1A5B4961-384D-4769-BF75-B020B67832ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/157dbc4a321f5bb6f8b6c724d12ba720a90f1a7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a26d50f8a4a5049e956984797b5d0dedea4bbb18\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T10:33:24+00:00",
      "cve": "CVE-2025-37996",
      "id": "CVE-2025-37996",
      "initial_release_date": "2025-05-29T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37996.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:58:04Z",
      "cve": "CVE-2025-37996",
      "id": "CVE-2025-37996",
      "initial_release_date": "2025-05-30T01:26:35Z",
      "product_status:known_not_affected": "505",
      "product_status:recommended": "78",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37996",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37996.json",
      "version": "17"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.