CVE-2025-37916: pds_core: remove write-after-free of client_id
In the Linux kernel, the following vulnerability has been resolved:
pdscore: remove write-after-free of clientid
A use-after-free error popped up in stress testing:
[Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdscauxbusdevdel+0xef/0x160 [pdscore] [Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47): [Mon Apr 21 21:21:33 2025] pdscauxbusdevdel+0xef/0x160 [pdscore] [Mon Apr 21 21:21:33 2025] pdscremove+0xc0/0x1b0 [pdscore] [Mon Apr 21 21:21:33 2025] pcideviceremove+0x24/0x70 [Mon Apr 21 21:21:33 2025] devicereleasedriverinternal+0x11f/0x180 [Mon Apr 21 21:21:33 2025] driverdetach+0x45/0x80 [Mon Apr 21 21:21:33 2025] busremovedriver+0x83/0xe0 [Mon Apr 21 21:21:33 2025] pciunregisterdriver+0x1a/0x80
The actual device uninit usually happens on a separate thread scheduled after this code runs, but there is no guarantee of order of thread execution, so this could be a problem. There's no actual need to clear the clientid at this point, so simply remove the offending code.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37916?
CVE-2025-37916 has been classified as a moderate severity vulnerability due to its nature involving a use-after-free condition.
How do I fix CVE-2025-37916?
To remediate CVE-2025-37916, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What components are affected by CVE-2025-37916?
CVE-2025-37916 specifically affects the Linux kernel, particularly in the pds_core module.
Is CVE-2025-37916 exploitable remotely?
CVE-2025-37916 is not deemed to be remotely exploitable but could be triggered under specific configurations.
What are the potential impacts of CVE-2025-37916?
The potential impacts of CVE-2025-37916 include system instability, data corruption, or unauthorized access due to the write-after-free vulnerability.