PT-2025-20539 · Linux+5 · Linux Kernel+5
Published
2025-04-24
·
Updated
2026-04-20
·
CVE-2025-37887
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability in the Linux kernel has been resolved. The issue occurs when the firmware does not support the PDS CORE CMD FW CONTROL command, potentially causing the driver to print garbage or crash when the "devlink dev info" devlink command is run. This happens because the stack variable
fw list is not initialized, resulting in a garbage value for fw list.num fw slots. The driver then tries to access fw list.fw names[i] with i greater than or equal to ARRAY SIZE, running off the end of the array.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use of Uninitialized Resource
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu