GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37879 (GCVE-0-2025-37879)

Vulnerability from cvelistv5 – Published: 2025-05-09 06:45 – Updated: 2026-08-05 11:58
VLAI
Title
9p/net: fix improper handling of bogus negative read/write replies
Summary
In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9_client_write() and p9_client_read_once(), if the server incorrectly replies with success but a negative write/read count then we would consider written (negative) <= rsize (positive) because both variables were signed. Make variables unsigned to avoid this problem. The reproducer linked below now fails with the following error instead of a null pointer deref: 9pnet: bogus RWRITE count (4294967295 > 3)
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 070b3656cf228eaaef7b28b59264c5c7cdbdd0fb , < 468ff4a7c61fb811c596a7c44b6a5455e40fd12b (git)
Affected: 070b3656cf228eaaef7b28b59264c5c7cdbdd0fb , < a68768e280b7d0c967ea509e791bb9b90adc94a5 (git)
Affected: 070b3656cf228eaaef7b28b59264c5c7cdbdd0fb , < c548f95688e2b5ae0e2ae43d53cf717156c7d034 (git)
Affected: 070b3656cf228eaaef7b28b59264c5c7cdbdd0fb , < 374e4cd75617c8c2552f562f39dd989583f5c330 (git)
Affected: 070b3656cf228eaaef7b28b59264c5c7cdbdd0fb , < d0259a856afca31d699b706ed5e2adf11086c73b (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.1
Unaffected: 0 , < 4.1 (semver)
Unaffected: 6.1.136 , ≤ 6.1.* (semver)
Unaffected: 6.6.89 , ≤ 6.6.* (semver)
Unaffected: 6.12.26 , ≤ 6.12.* (semver)
Unaffected: 6.14.5 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:56:51.125Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/9p/client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "468ff4a7c61fb811c596a7c44b6a5455e40fd12b",
              "status": "affected",
              "version": "070b3656cf228eaaef7b28b59264c5c7cdbdd0fb",
              "versionType": "git"
            },
            {
              "lessThan": "a68768e280b7d0c967ea509e791bb9b90adc94a5",
              "status": "affected",
              "version": "070b3656cf228eaaef7b28b59264c5c7cdbdd0fb",
              "versionType": "git"
            },
            {
              "lessThan": "c548f95688e2b5ae0e2ae43d53cf717156c7d034",
              "status": "affected",
              "version": "070b3656cf228eaaef7b28b59264c5c7cdbdd0fb",
              "versionType": "git"
            },
            {
              "lessThan": "374e4cd75617c8c2552f562f39dd989583f5c330",
              "status": "affected",
              "version": "070b3656cf228eaaef7b28b59264c5c7cdbdd0fb",
              "versionType": "git"
            },
            {
              "lessThan": "d0259a856afca31d699b706ed5e2adf11086c73b",
              "status": "affected",
              "version": "070b3656cf228eaaef7b28b59264c5c7cdbdd0fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/9p/client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.136",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.89",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p/net: fix improper handling of bogus negative read/write replies\n\nIn p9_client_write() and p9_client_read_once(), if the server\nincorrectly replies with success but a negative write/read count then we\nwould consider written (negative) \u003c= rsize (positive) because both\nvariables were signed.\n\nMake variables unsigned to avoid this problem.\n\nThe reproducer linked below now fails with the following error instead\nof a null pointer deref:\n9pnet: bogus RWRITE count (4294967295 \u003e 3)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The attacker is the remote 9p file server, reachable over the TCP transport (`p9_fd_create_tcp`, port 564) or RDMA; 9p is unauthenticated and unencrypted on the wire, so a malicious server or an on-path MITM can inject the bogus RWRITE reply. The same primitive is available to a malicious hypervisor backend over virtio/Xen.\nAC:L - The server simply answers any TWRITE with a success reply carrying count 0xFFFFFFFF, deterministically bypassing the signed `rsize \u003c written` check. There is no race, no timing window, and no dependence on memory layout to reach the corruption.\nPR:N - The malicious 9p server is a remote peer holding no credentials or account on the victim client; 9p mounts commonly use auth=none, and an on-path attacker needs nothing at all. The mount being present is an environmental precondition, not a privilege held by the attacker.\nUI:N - On an already-mounted 9p share the bug fires on ordinary I/O, including kernel-initiated page-cache writeback via `v9fs_issue_write`, with no victim action required. No specific human interaction beyond the pre-existing mount configuration is needed.\nS:U - The corruption is confined to the 9p client kernel that parsed the reply, with no crossing into a different security authority such as a hypervisor or IOMMU boundary. Impact stays within the victim kernel\u0027s own scope.\nC:H - The over-revert leaves `i-\u003ebvec`/`i-\u003e__iov` pointing before the start of the bio_vec/kvec array, and because `p9_client_write()` keeps looping the next TWRITE marshals data from that out-of-bounds descriptor \u2014 sending adjacent kernel heap or stack memory straight to the attacker-controlled server. This is a repeatable kernel memory disclosure primitive.\nI:H - The same out-of-bounds iterator descriptor supplies attacker-uncontrolled `bv_page`/`iov_base` pointers used for subsequent copies, giving out-of-bounds kernel memory access leveragable for control-flow hijack. Additionally `offset += written` sign-extends the negative count into the u64 file offset and `total` goes negative, corrupting file data placement and netfs transfer accounting.\nA:H - The reported and reproduced result is a NULL pointer dereference in `iov_iter_folioq_revert()` when `folioq-\u003eprev` is NULL at the queue head, and `ITER_UBUF`/`ITER_XARRAY` hit an explicit `BUG()` in `iov_iter_revert()`. The write loop also never terminates because `i-\u003ecount` grows by one each iteration, hanging the task."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:00.365Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/468ff4a7c61fb811c596a7c44b6a5455e40fd12b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a68768e280b7d0c967ea509e791bb9b90adc94a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c548f95688e2b5ae0e2ae43d53cf717156c7d034"
        },
        {
          "url": "https://git.kernel.org/stable/c/374e4cd75617c8c2552f562f39dd989583f5c330"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0259a856afca31d699b706ed5e2adf11086c73b"
        }
      ],
      "title": "9p/net: fix improper handling of bogus negative read/write replies",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37879",
    "datePublished": "2025-05-09T06:45:43.197Z",
    "dateReserved": "2025-04-16T04:51:23.962Z",
    "dateUpdated": "2026-08-05T11:58:00.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37879",
      "date": "2026-09-16",
      "epss": "0.00682",
      "percentile": "0.50779"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-11T01:41:57.000Z",
      "cve": "CVE-2025-37879",
      "id": "msrc_CVE-2025-37879",
      "initial_release_date": "2025-07-11T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "7",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "9p/net: fix improper handling of bogus negative read/write replies",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-37879.json",
      "version": "6"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37879\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-09T07:16:09.143\",\"lastModified\":\"2026-07-30T06:22:27.160\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\n9p/net: fix improper handling of bogus negative read/write replies\\n\\nIn p9_client_write() and p9_client_read_once(), if the server\\nincorrectly replies with success but a negative write/read count then we\\nwould consider written (negative) \u003c= rsize (positive) because both\\nvariables were signed.\\n\\nMake variables unsigned to avoid this problem.\\n\\nThe reproducer linked below now fails with the following error instead\\nof a null pointer deref:\\n9pnet: bogus RWRITE count (4294967295 \u003e 3)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: 9p/net: se corrige el manejo incorrecto de respuestas de lectura/escritura negativas falsas. En p9_client_write() y p9_client_read_once(), si el servidor responde incorrectamente con \u00e9xito, pero con un recuento de escrituras/lecturas negativo, se considerar\u00eda que \\\"escrito\\\" (negativo) \u0026lt;= \\\"rsize\\\" (positivo) porque ambas variables estaban firmadas. Para evitar este problema, desactive el signo de las variables. El reproductor enlazado a continuaci\u00f3n ahora falla con el siguiente error en lugar de una referencia de puntero nulo: 9pnet: recuento de RWRITE falso (4294967295 \u0026gt; 3)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/9p/client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"070b3656cf228eaaef7b28b59264c5c7cdbdd0fb\",\"lessThan\":\"468ff4a7c61fb811c596a7c44b6a5455e40fd12b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"070b3656cf228eaaef7b28b59264c5c7cdbdd0fb\",\"lessThan\":\"a68768e280b7d0c967ea509e791bb9b90adc94a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"070b3656cf228eaaef7b28b59264c5c7cdbdd0fb\",\"lessThan\":\"c548f95688e2b5ae0e2ae43d53cf717156c7d034\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"070b3656cf228eaaef7b28b59264c5c7cdbdd0fb\",\"lessThan\":\"374e4cd75617c8c2552f562f39dd989583f5c330\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"070b3656cf228eaaef7b28b59264c5c7cdbdd0fb\",\"lessThan\":\"d0259a856afca31d699b706ed5e2adf11086c73b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/9p/client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.136\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.89\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.26\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.5\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.136\",\"matchCriteriaId\":\"05A05DE3-3248-434C-8967-0FB26A540FA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.89\",\"matchCriteriaId\":\"D79CE030-3114-45E0-B52B-C77781BCB587\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.26\",\"matchCriteriaId\":\"22F52099-F422-4D19-8283-45F9F9BF4392\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.5\",\"matchCriteriaId\":\"6B25CA7E-4CD0-46DB-B4EF-13A3516071FB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/374e4cd75617c8c2552f562f39dd989583f5c330\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/468ff4a7c61fb811c596a7c44b6a5455e40fd12b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a68768e280b7d0c967ea509e791bb9b90adc94a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c548f95688e2b5ae0e2ae43d53cf717156c7d034\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0259a856afca31d699b706ed5e2adf11086c73b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:28:00+00:00",
      "cve": "CVE-2025-37879",
      "id": "CVE-2025-37879",
      "initial_release_date": "2025-05-09T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: 9p/net: fix improper handling of bogus negative read/write replies",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37879.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:58:45Z",
      "cve": "CVE-2025-37879",
      "id": "CVE-2025-37879",
      "initial_release_date": "2025-05-10T02:52:25Z",
      "product_status:known_affected": "782",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "437",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37879",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37879.json",
      "version": "42"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.