CVE-2025-37751 (GCVE-0-2025-37751)

Vulnerability from cvelistv5 – Published: 2025-05-01 12:55 – Updated: 2026-08-05 11:57
VLAI
Title
x86/cpu: Avoid running off the end of an AMD erratum table
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/cpu: Avoid running off the end of an AMD erratum table The NULL array terminator at the end of erratum_1386_microcode was removed during the switch from x86_cpu_desc to x86_cpu_id. This causes readers to run off the end of the array. Replace the NULL.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f3f3251526739bb975b97f840c56b3054dba8638 , < 1b518f73f1b6f59e083ec33dea22d9a1a275a970 (git)
Affected: f3f3251526739bb975b97f840c56b3054dba8638 , < f0df00ebc57f803603f2a2e0df197e51f06fbe90 (git)
Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.14.3 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/amd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b518f73f1b6f59e083ec33dea22d9a1a275a970",
              "status": "affected",
              "version": "f3f3251526739bb975b97f840c56b3054dba8638",
              "versionType": "git"
            },
            {
              "lessThan": "f0df00ebc57f803603f2a2e0df197e51f06fbe90",
              "status": "affected",
              "version": "f3f3251526739bb975b97f840c56b3054dba8638",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/amd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.3",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cpu: Avoid running off the end of an AMD erratum table\n\nThe NULL array terminator at the end of erratum_1386_microcode was\nremoved during the switch from x86_cpu_desc to x86_cpu_id. This\ncauses readers to run off the end of the array.\n\nReplace the NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overrunning scan is reached only via `identify_cpu()` during boot-CPU init or secondary-CPU bring-up (`common.c:1887`, `common.c:2009`); no network packet, remote peer data, or adjacent-network frame reaches this path.\nAC:L - On any Zen1/Zen2 part not matched by the two valid entries \u2014 the overwhelming majority of affected hardware \u2014 the scan deterministically crosses the array boundary on every CPU init, with no race, timing window, or attacker-independent precondition.\nPR:L - There is no capability, namespace, or authentication check on the path \u2014 `fix_erratum_1386()` runs automatically during CPU initialization; conservatively a basic local foothold suffices rather than init-namespace root.\nUI:N - The out-of-bounds walk occurs autonomously during CPU initialization; no victim must mount media, open a file, or take any other action.\nS:U - The invalid read and its consequences stay entirely within the affected kernel\u0027s own security authority; no guest-to-host, IOMMU, or sandbox boundary is crossed.\nC:H - The missing sentinel makes the read source-unbounded \u2014 the loop consumes adjacent kernel `.rodata` and beyond with no length check, matching the CWE-125/C:H classification applied to the identical prior defect in this same table (CVE-2024-56721).\nI:N - The overrun is purely a read; no out-of-bounds-derived value is used as a write address or control-flow target, and the only downstream effect is a build-dependent, non-attacker-steerable decision about clearing `X86_FEATURE_XSAVES`.\nA:H - KASAN flags the access as a global-out-of-bounds, and `panic_on_warn` or `kasan.fault=panic` converts it into a kernel panic during boot or CPU bring-up; an unterminated walk reaching unmapped memory faults in the same early context, leaving the system unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:15.932Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b518f73f1b6f59e083ec33dea22d9a1a275a970"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0df00ebc57f803603f2a2e0df197e51f06fbe90"
        }
      ],
      "title": "x86/cpu: Avoid running off the end of an AMD erratum table",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37751",
    "datePublished": "2025-05-01T12:55:56.624Z",
    "dateReserved": "2025-04-16T04:51:23.937Z",
    "dateUpdated": "2026-08-05T11:57:15.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37751",
      "date": "2026-08-07",
      "epss": "0.00152",
      "percentile": "0.04901"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37751\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T13:15:53.843\",\"lastModified\":\"2026-07-30T06:22:18.927\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/cpu: Avoid running off the end of an AMD erratum table\\n\\nThe NULL array terminator at the end of erratum_1386_microcode was\\nremoved during the switch from x86_cpu_desc to x86_cpu_id. This\\ncauses readers to run off the end of the array.\\n\\nReplace the NULL.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/cpu: Evitar la ejecuci\u00f3n al final de una tabla de erratas de AMD. El terminador de matriz NULL al final de erratum_1386_microcode se elimin\u00f3 durante la migraci\u00f3n de x86_cpu_desc a x86_cpu_id. Esto provoca que los lectores se ejecuten al final de la matriz. Reemplace el NULL.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kernel/cpu/amd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f3f3251526739bb975b97f840c56b3054dba8638\",\"lessThan\":\"1b518f73f1b6f59e083ec33dea22d9a1a275a970\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3f3251526739bb975b97f840c56b3054dba8638\",\"lessThan\":\"f0df00ebc57f803603f2a2e0df197e51f06fbe90\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kernel/cpu/amd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.3\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.3\",\"matchCriteriaId\":\"483E2E15-2135-4EC6-AB64-16282C5EF704\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1b518f73f1b6f59e083ec33dea22d9a1a275a970\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0df00ebc57f803603f2a2e0df197e51f06fbe90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:36:08+00:00",
      "cve": "CVE-2025-37751",
      "id": "CVE-2025-37751",
      "initial_release_date": "2025-05-01T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "246",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: x86/cpu: Avoid running off the end of an AMD erratum table",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37751.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:16:19Z",
      "cve": "CVE-2025-37751",
      "id": "CVE-2025-37751",
      "initial_release_date": "2025-05-02T02:03:00Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "344",
      "product_status:recommended": "283",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37751",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37751.json",
      "version": "27"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.