CVE-2025-37949 (GCVE-0-2025-37949)

Vulnerability from cvelistv5 – Published: 2025-05-20 16:01 – Updated: 2026-08-05 11:58
VLAI
Title
xenbus: Use kref to track req lifetime
Summary
In the Linux kernel, the following vulnerability has been resolved: xenbus: Use kref to track req lifetime Marek reported seeing a NULL pointer fault in the xenbus_thread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:__wake_up_common+0x4c/0x180 Call Trace: <TASK> __wake_up_common_lock+0x82/0xd0 process_msg+0x18e/0x2f0 xenbus_thread+0x165/0x1c0 process_msg+0x18e is req->cb(req). req->cb is set to xs_wake_up(), a thin wrapper around wake_up(), or xenbus_dev_queue_reply(). It seems like it was xs_wake_up() in this case. It seems like req may have woken up the xs_wait_for_reply(), which kfree()ed the req. When xenbus_thread resumes, it faults on the zero-ed data. Linux Device Drivers 2nd edition states: "Normally, a wake_up call can cause an immediate reschedule to happen, meaning that other processes might run before wake_up returns." ... which would match the behaviour observed. Change to keeping two krefs on each request. One for the caller, and one for xenbus_thread. Each will kref_put() when finished, and the last will free it. This use of kref matches the description in Documentation/core-api/kref.rst
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fd8aa9095a95c02dcc35540a263267c29b8fda9d , < 0e94a246bb6d9538010b6c02d2b1d4717a97b2e5 (git)
Affected: fd8aa9095a95c02dcc35540a263267c29b8fda9d , < f1bcac367bc95631afbb918348f30dec887d0e1b (git)
Affected: fd8aa9095a95c02dcc35540a263267c29b8fda9d , < 4d260a5558df4650eb87bc41b2c9ac2d6b2ba447 (git)
Affected: fd8aa9095a95c02dcc35540a263267c29b8fda9d , < 8b02f85e84dc6f7c150cef40ddb69af5a25659e5 (git)
Affected: fd8aa9095a95c02dcc35540a263267c29b8fda9d , < cbfaf46b88a4c01b64c4186cdccd766c19ae644c (git)
Affected: fd8aa9095a95c02dcc35540a263267c29b8fda9d , < 8e9c8a0393b5f85f1820c565ab8105660f4e8f92 (git)
Affected: fd8aa9095a95c02dcc35540a263267c29b8fda9d , < 2466b0f66795c3c426cacc8998499f38031dbb59 (git)
Affected: fd8aa9095a95c02dcc35540a263267c29b8fda9d , < 1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27 (git)
Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.4.294 , ≤ 5.4.* (semver)
Unaffected: 5.10.238 , ≤ 5.10.* (semver)
Unaffected: 5.15.183 , ≤ 5.15.* (semver)
Unaffected: 6.1.139 , ≤ 6.1.* (semver)
Unaffected: 6.6.91 , ≤ 6.6.* (semver)
Unaffected: 6.12.29 , ≤ 6.12.* (semver)
Unaffected: 6.14.7 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:57:40.135Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/xenbus/xenbus.h",
            "drivers/xen/xenbus/xenbus_comms.c",
            "drivers/xen/xenbus/xenbus_dev_frontend.c",
            "drivers/xen/xenbus/xenbus_xs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e94a246bb6d9538010b6c02d2b1d4717a97b2e5",
              "status": "affected",
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "versionType": "git"
            },
            {
              "lessThan": "f1bcac367bc95631afbb918348f30dec887d0e1b",
              "status": "affected",
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "versionType": "git"
            },
            {
              "lessThan": "4d260a5558df4650eb87bc41b2c9ac2d6b2ba447",
              "status": "affected",
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "versionType": "git"
            },
            {
              "lessThan": "8b02f85e84dc6f7c150cef40ddb69af5a25659e5",
              "status": "affected",
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "versionType": "git"
            },
            {
              "lessThan": "cbfaf46b88a4c01b64c4186cdccd766c19ae644c",
              "status": "affected",
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "versionType": "git"
            },
            {
              "lessThan": "8e9c8a0393b5f85f1820c565ab8105660f4e8f92",
              "status": "affected",
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "versionType": "git"
            },
            {
              "lessThan": "2466b0f66795c3c426cacc8998499f38031dbb59",
              "status": "affected",
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "versionType": "git"
            },
            {
              "lessThan": "1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27",
              "status": "affected",
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/xenbus/xenbus.h",
            "drivers/xen/xenbus/xenbus_comms.c",
            "drivers/xen/xenbus/xenbus_dev_frontend.c",
            "drivers/xen/xenbus/xenbus_xs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.294",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.294",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.183",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.139",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.91",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.29",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.7",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxenbus: Use kref to track req lifetime\n\nMarek reported seeing a NULL pointer fault in the xenbus_thread\ncallstack:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: e030:__wake_up_common+0x4c/0x180\nCall Trace:\n \u003cTASK\u003e\n __wake_up_common_lock+0x82/0xd0\n process_msg+0x18e/0x2f0\n xenbus_thread+0x165/0x1c0\n\nprocess_msg+0x18e is req-\u003ecb(req).  req-\u003ecb is set to xs_wake_up(), a\nthin wrapper around wake_up(), or xenbus_dev_queue_reply().  It seems\nlike it was xs_wake_up() in this case.\n\nIt seems like req may have woken up the xs_wait_for_reply(), which\nkfree()ed the req.  When xenbus_thread resumes, it faults on the zero-ed\ndata.\n\nLinux Device Drivers 2nd edition states:\n\"Normally, a wake_up call can cause an immediate reschedule to happen,\nmeaning that other processes might run before wake_up returns.\"\n... which would match the behaviour observed.\n\nChange to keeping two krefs on each request.  One for the caller, and\none for xenbus_thread.  Each will kref_put() when finished, and the last\nwill free it.\n\nThis use of kref matches the description in\nDocumentation/core-api/kref.rst"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is between the in-guest `xenbus_thread` and a local task blocked in `read_reply()`; it is driven by local writes to the `/dev/xen/xenbus` (or `/proc/xen/xenbus`) character device or by local sysfs/kernel-initiated xenstore requests. No network protocol handling is involved, so this requires local access to the Xen guest or dom0.\nAC:L - The attacker controls both sides of the race \u2014 their own thread is the waiter that performs the `kfree()`, and they issue the requests that cause `xenbus_thread` to call `wake_up()` \u2014 so they can retry unbounded, pin the racing threads to separate CPUs, and add scheduler load to widen the window. The bug is known to fire spontaneously during ordinary operation, confirming no attacker-uncontrollable precondition.\nPR:L - There is no `capable()` or credential check anywhere on the vulnerable path \u2014 unlike `xenbus_dev_backend.c` which gates on `CAP_SYS_ADMIN`, `xen_xenbus_fops` has none, so any user granted the xenbus device node can drive `XS_WATCH`/`XS_UNWATCH` into `xs_talkv()`; the world-readable `/sys/hypervisor/uuid` (mode 0444) also reaches `xenbus_read()` \u2192 `xs_talkv()`. A basic unprivileged local account suffices in realistic Xen deployments.\nUI:N - The attacker triggers the race entirely from their own thread pair by issuing xenstore requests and waiting for replies; no victim action, mount, or file open is required.\nS:U - The freed `xb_req_data` and the resulting corruption both live in the same kernel\u0027s slab, so the impact stays within the compromised guest\u0027s (or dom0\u0027s) security authority. No hypervisor, IOMMU, or VM boundary is crossed by the memory corruption itself.\nC:H - The use-after-free lets the attacker reallocate the freed `xb_req_data` with sprayed content that `__wake_up_common` then reads as a `wait_queue_entry` list, and the corrupted-object primitive is readily leveraged into arbitrary kernel memory disclosure. The object comes from a generic `kmalloc-128`/`kmalloc-192` cache shared with attacker-controllable allocations.\nI:H - `__wake_up_common` performs an indirect call `curr-\u003efunc(curr, ...)` through a pointer read from the freed object, and `spin_unlock_irqrestore()` writes into the freed slot after reallocation \u2014 giving both control-flow hijack and a targeted write primitive, i.e. full kernel privilege escalation potential.\nA:H - The reported real-world symptom is a kernel NULL pointer dereference and oops in `__wake_up_common` from `xenbus_thread`, killing the xenstore transport thread and panicking the kernel. Any unsuccessful exploitation attempt likewise crashes the guest or dom0."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:34.906Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e94a246bb6d9538010b6c02d2b1d4717a97b2e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1bcac367bc95631afbb918348f30dec887d0e1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d260a5558df4650eb87bc41b2c9ac2d6b2ba447"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b02f85e84dc6f7c150cef40ddb69af5a25659e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbfaf46b88a4c01b64c4186cdccd766c19ae644c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e9c8a0393b5f85f1820c565ab8105660f4e8f92"
        },
        {
          "url": "https://git.kernel.org/stable/c/2466b0f66795c3c426cacc8998499f38031dbb59"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27"
        }
      ],
      "title": "xenbus: Use kref to track req lifetime",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37949",
    "datePublished": "2025-05-20T16:01:45.242Z",
    "dateReserved": "2025-04-16T04:51:23.972Z",
    "dateUpdated": "2026-08-05T11:58:34.906Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37949",
      "date": "2026-08-05",
      "epss": "0.00176",
      "percentile": "0.07323"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37949\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:32.920\",\"lastModified\":\"2026-07-30T06:22:36.617\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxenbus: Use kref to track req lifetime\\n\\nMarek reported seeing a NULL pointer fault in the xenbus_thread\\ncallstack:\\nBUG: kernel NULL pointer dereference, address: 0000000000000000\\nRIP: e030:__wake_up_common+0x4c/0x180\\nCall Trace:\\n \u003cTASK\u003e\\n __wake_up_common_lock+0x82/0xd0\\n process_msg+0x18e/0x2f0\\n xenbus_thread+0x165/0x1c0\\n\\nprocess_msg+0x18e is req-\u003ecb(req).  req-\u003ecb is set to xs_wake_up(), a\\nthin wrapper around wake_up(), or xenbus_dev_queue_reply().  It seems\\nlike it was xs_wake_up() in this case.\\n\\nIt seems like req may have woken up the xs_wait_for_reply(), which\\nkfree()ed the req.  When xenbus_thread resumes, it faults on the zero-ed\\ndata.\\n\\nLinux Device Drivers 2nd edition states:\\n\\\"Normally, a wake_up call can cause an immediate reschedule to happen,\\nmeaning that other processes might run before wake_up returns.\\\"\\n... which would match the behaviour observed.\\n\\nChange to keeping two krefs on each request.  One for the caller, and\\none for xenbus_thread.  Each will kref_put() when finished, and the last\\nwill free it.\\n\\nThis use of kref matches the description in\\nDocumentation/core-api/kref.rst\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xenbus: Usar kref para rastrear el tiempo de vida de req. Marek inform\u00f3 haber visto un fallo de puntero nulo en la pila de llamadas xenbus_thread: ERROR: desreferencia de puntero nulo del kernel, direcci\u00f3n: 0000000000000000 RIP: e030:__wake_up_common+0x4c/0x180 Rastreo de llamadas:  __wake_up_common_lock+0x82/0xd0 process_msg+0x18e/0x2f0 xenbus_thread+0x165/0x1c0 process_msg+0x18e es req-\u0026gt;cb(req). req-\u0026gt;cb est\u00e1 configurado como xs_wake_up(), una envoltura ligera alrededor de wake_up(), o xenbus_dev_queue_reply(). Parece que en este caso era xs_wake_up(). Parece que req pudo haber despertado xs_wait_for_reply(), que liber\u00f3 la solicitud. Cuando xenbus_thread se reanuda, falla en los datos con ceros. La segunda edici\u00f3n de los controladores de dispositivos de Linux indica: \u00abNormalmente, una llamada wake_up puede provocar una reprogramaci\u00f3n inmediata, lo que significa que otros procesos podr\u00edan ejecutarse antes de que wake_up regrese\u00bb. ... lo cual coincidir\u00eda con el comportamiento observado. Se recomienda mantener dos krefs en cada solicitud: uno para el que realiza la llamada y otro para xenbus_thread. Cada uno ejecutar\u00e1 kref_put() al finalizar, y el \u00faltimo lo liberar\u00e1. Este uso de kref coincide con la descripci\u00f3n en Documentation/core-api/kref.rst.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/xen/xenbus/xenbus.h\",\"drivers/xen/xenbus/xenbus_comms.c\",\"drivers/xen/xenbus/xenbus_dev_frontend.c\",\"drivers/xen/xenbus/xenbus_xs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fd8aa9095a95c02dcc35540a263267c29b8fda9d\",\"lessThan\":\"0e94a246bb6d9538010b6c02d2b1d4717a97b2e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd8aa9095a95c02dcc35540a263267c29b8fda9d\",\"lessThan\":\"f1bcac367bc95631afbb918348f30dec887d0e1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd8aa9095a95c02dcc35540a263267c29b8fda9d\",\"lessThan\":\"4d260a5558df4650eb87bc41b2c9ac2d6b2ba447\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd8aa9095a95c02dcc35540a263267c29b8fda9d\",\"lessThan\":\"8b02f85e84dc6f7c150cef40ddb69af5a25659e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd8aa9095a95c02dcc35540a263267c29b8fda9d\",\"lessThan\":\"cbfaf46b88a4c01b64c4186cdccd766c19ae644c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd8aa9095a95c02dcc35540a263267c29b8fda9d\",\"lessThan\":\"8e9c8a0393b5f85f1820c565ab8105660f4e8f92\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd8aa9095a95c02dcc35540a263267c29b8fda9d\",\"lessThan\":\"2466b0f66795c3c426cacc8998499f38031dbb59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd8aa9095a95c02dcc35540a263267c29b8fda9d\",\"lessThan\":\"1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/xen/xenbus/xenbus.h\",\"drivers/xen/xenbus/xenbus_comms.c\",\"drivers/xen/xenbus/xenbus_dev_frontend.c\",\"drivers/xen/xenbus/xenbus_xs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.294\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.238\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.183\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.139\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.91\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.29\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.7\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.11\",\"versionEndExcluding\":\"5.4.294\",\"matchCriteriaId\":\"52FE04D3-53CF-427A-9E0F-9F05797D36D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.238\",\"matchCriteriaId\":\"0DAAEF7F-D560-47FC-8B65-20404DB82432\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.183\",\"matchCriteriaId\":\"94D91ED4-346E-41EE-ACF5-F184C0A863D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.139\",\"matchCriteriaId\":\"70A2F216-574B-4B80-86BC-988928D5B83D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.91\",\"matchCriteriaId\":\"B6826C73-C5C9-430D-84C9-4045DFD72074\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.29\",\"matchCriteriaId\":\"7215ABCF-8EB1-46CD-8872-8BCE4890E579\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.7\",\"matchCriteriaId\":\"5715A6F5-A34A-4B27-8A64-82825E963995\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e94a246bb6d9538010b6c02d2b1d4717a97b2e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2466b0f66795c3c426cacc8998499f38031dbb59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4d260a5558df4650eb87bc41b2c9ac2d6b2ba447\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b02f85e84dc6f7c150cef40ddb69af5a25659e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8e9c8a0393b5f85f1820c565ab8105660f4e8f92\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cbfaf46b88a4c01b64c4186cdccd766c19ae644c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1bcac367bc95631afbb918348f30dec887d0e1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:32:15+00:00",
      "cve": "CVE-2025-37949",
      "id": "CVE-2025-37949",
      "initial_release_date": "2025-05-20T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xenbus: Use kref to track req lifetime",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37949.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T06:16:31Z",
      "cve": "CVE-2025-37949",
      "id": "CVE-2025-37949",
      "initial_release_date": "2025-05-21T00:46:31Z",
      "product_status:known_affected": "669",
      "product_status:known_not_affected": "22",
      "product_status:recommended": "407",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37949",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37949.json",
      "version": "34"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.