CVE-2025-37857: scsi: st: Fix array overflow in st_setup()
Published May 9, 2025
·Updated
In the Linux kernel, the following vulnerability has been resolved:
scsi: st: Fix array overflow in stsetup()
Change the array size to follow parms size instead of a fixed value.
Affected Software
12 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel<5.4.293
Linux Linux kernel>=5.5<5.10.237
Linux Linux kernel>=5.11<5.15.181
Linux Linux kernel>=5.16<6.1.135
Linux Linux kernel>=6.2<6.6.88
Linux Linux kernel>=6.7<6.12.24
Linux Linux kernel>=6.13<6.13.12
Linux Linux kernel>=6.14<6.14.3
Debian Debian Linux=11.0
Microsoft azl3 kernel 6.6.85.1-4
Microsoft azl3 kernel 6.6.92.2-1
Remediation
Event History
May 9, 2025
CVE Published
via MITRE·06:42 AM
Data Sourced
via MITRE·06:42 AM
Description
Data Sourced
via NVD·07:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 11, 2025
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2025-37857?
CVE-2025-37857 has been classified as a moderate severity vulnerability in the Linux kernel.
2
What systems are affected by CVE-2025-37857?
CVE-2025-37857 affects the Linux kernel, specifically the scsi: st driver implementation.
3
How do I fix CVE-2025-37857?
To fix CVE-2025-37857, you should update your Linux kernel to the latest version that includes the fix for this vulnerability.
4
What is the impact of CVE-2025-37857 on my system?
CVE-2025-37857 can potentially lead to an array overflow in the scsi: st driver, which may result in system instability or crashes.
5
Is there a workaround for CVE-2025-37857?
There are no known workarounds for CVE-2025-37857; updating the kernel is the recommended solution.