What is the severity of CVE-2025-37887?

CVE-2025-37887 has been classified as a high severity vulnerability in the Linux kernel.

How do I fix CVE-2025-37887?

To fix CVE-2025-37887, update to the latest version of the Linux kernel where this vulnerability has been patched.

What systems are affected by CVE-2025-37887?

CVE-2025-37887 affects the Linux kernel, particularly versions prior to the patch that resolves this issue.

What type of vulnerability is CVE-2025-37887?

CVE-2025-37887 is a vulnerability related to improper handling of unsupported commands in the PDS_CORE_CMD_FW_CONTROL.

What can happen if CVE-2025-37887 is exploited?

Exploiting CVE-2025-37887 could lead to potential crashes or erroneous outputs from the Linux kernel driver.

Vulnerability/
CVE-2025-37887

9/5/2025

CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result

First published: Fri May 09 2025(Updated: )

In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command the driver might at the least print garbage and at the worst crash when the user runs the "devlink dev info" devlink command. This happens because the stack variable fw_list is not 0 initialized which results in fw_list.num_fw_slots being a garbage value from the stack. Then the driver tries to access fw_list.fw_names[i] with i >= ARRAY_SIZE and runs off the end of the array. Fix this by initializing the fw_list and by not failing completely if the devcmd fails because other useful information is printed via devlink dev info even if the devcmd fails.

Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Affected Software	Affected Version	How to fix
Linux kernel

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2025-37887?
CVE-2025-37887 has been classified as a high severity vulnerability in the Linux kernel.
How do I fix CVE-2025-37887?
To fix CVE-2025-37887, update to the latest version of the Linux kernel where this vulnerability has been patched.
What systems are affected by CVE-2025-37887?
CVE-2025-37887 affects the Linux kernel, particularly versions prior to the patch that resolves this issue.
What type of vulnerability is CVE-2025-37887?
CVE-2025-37887 is a vulnerability related to improper handling of unsupported commands in the PDS_CORE_CMD_FW_CONTROL.
What can happen if CVE-2025-37887 is exploited?
Exploiting CVE-2025-37887 could lead to potential crashes or erroneous outputs from the Linux kernel driver.

collector/mitre-cve
source/MITRE
agent/title
agent/references
agent/description
agent/type
agent/first-publish-date
agent/softwarecombine
collector/nvd-api
source/NVD
agent/author
agent/last-modified-date
agent/source
agent/event
agent/tags
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/linux
canonical/linux kernel

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.