PT-2025-22157 · Linux+4 · Linux Kernel+4

Published 2025-04-30 · Updated 2026-04-03 · CVE-2025-37895

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the bnxt en driver. The issue occurs when the bnxt init chip() function fails, triggering a WARN ON() in flush work() because cancel work sync() is called on uninitialized dim work. The driver relies on the BNXT STATE NAPI DISABLED bit to check if dim work has been cancelled, but this bit is not set during the bnxt open() path, causing the error. The fix involves setting BNXT STATE NAPI DISABLED during initialization, which will be cleared when NAPI is enabled and dim work is initialized.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

BDU:2025-12243

CVE-2025-37895

USN-7649-1

USN-7649-2

USN-7650-1

USN-7665-1

USN-7665-2

USN-7721-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 144

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37895.json · Exploit
• https://ubuntu.com/security/CVE-2025-37968 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7649-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7650-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37911 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37954 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37955 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7721-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37898 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37917 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38083 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-37895 · Security Note
• https://ubuntu.com/security/CVE-2025-37956 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37930 · Vendor Advisory
• https://git.kernel.org/stable/c/e039b00ddbfeaa0dc59b8659be114f1a1b37c5bf · Patch