- Vulnerability/
- CVE-2025-37879
CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies
First published: Fri May 09 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9_client_write() and p9_client_read_once(), if the server incorrectly replies with success but a negative write/read count then we would consider written (negative) <= rsize (positive) because both variables were signed. Make variables unsigned to avoid this problem. The reproducer linked below now fails with the following error instead of a null pointer deref: 9pnet: bogus RWRITE count (4294967295 > 3)
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/468ff4a7c61fb811c596a7c44b6a5455e40fd12b
- https://git.kernel.org/stable/c/a68768e280b7d0c967ea509e791bb9b90adc94a5
- https://git.kernel.org/stable/c/c548f95688e2b5ae0e2ae43d53cf717156c7d034
- https://git.kernel.org/stable/c/374e4cd75617c8c2552f562f39dd989583f5c330
- https://git.kernel.org/stable/c/d0259a856afca31d699b706ed5e2adf11086c73b
Frequently Asked Questions
What is the severity of CVE-2025-37879?
CVE-2025-37879 has been categorized with a low severity level as it involves improper handling of negative read/write replies in the Linux kernel.
How do I fix CVE-2025-37879?
To remediate CVE-2025-37879, update the Linux kernel to the latest version where this vulnerability has been resolved.
What systems are affected by CVE-2025-37879?
CVE-2025-37879 affects various versions of the Linux kernel that implement the 9p network protocol.
What are the potential impacts of CVE-2025-37879?
The potential impacts of CVE-2025-37879 include improper handling of data during read/write operations, which could lead to data corruption.
Is there an update available for CVE-2025-37879?
Yes, an update addressing CVE-2025-37879 has been released and users are encouraged to apply the latest patches.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- vendor/linux
- canonical/linux kernel