CVE-2025-37949: xenbus: Use kref to track req lifetime
In the Linux kernel, the following vulnerability has been resolved:
xenbus: Use kref to track req lifetime
Marek reported seeing a NULL pointer fault in the xenbusthread callstack: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: e030:wakeupcommon+0x4c/0x180 Call Trace: <TASK> wakeupcommonlock+0x82/0xd0 processmsg+0x18e/0x2f0 xenbusthread+0x165/0x1c0
processmsg+0x18e is req->cb(req). req->cb is set to xswakeup(), a thin wrapper around wakeup(), or xenbusdevqueuereply(). It seems like it was xswakeup() in this case.
It seems like req may have woken up the xswaitforreply(), which kfree()ed the req. When xenbusthread resumes, it faults on the zero-ed data.
Linux Device Drivers 2nd edition states: "Normally, a wakeup call can cause an immediate reschedule to happen, meaning that other processes might run before wakeup returns." ... which would match the behaviour observed.
Change to keeping two krefs on each request. One for the caller, and one for xenbusthread. Each will krefput() when finished, and the last will free it.
This use of kref matches the description in Documentation/core-api/kref.rst
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In xenbus, use kref to track each request's lifetime: keep two krefs per request—one for the caller and one for xenbus_thread; each holder calls kref_put() when finished, and the final kref_put() frees the request.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37949?
CVE-2025-37949 has a moderate severity rating due to the potential for a NULL pointer dereference leading to system instability.
How do I fix CVE-2025-37949?
To fix CVE-2025-37949, upgrade to the latest stable version of the Linux kernel where the vulnerability has been addressed.
Which versions of the Linux kernel are affected by CVE-2025-37949?
CVE-2025-37949 affects multiple versions of the Linux kernel prior to the security patch that resolves this issue.
What could happen if CVE-2025-37949 is exploited?
If exploited, CVE-2025-37949 may lead to a system crash or other instability due to the NULL pointer dereference.
Who reported CVE-2025-37949?
CVE-2025-37949 was reported by Marek, highlighting a critical issue in the xenbus_thread functionality.