PT-2025-22195 · Linux+5 · Linux Kernel+5

Published 2025-04-30 · Updated 2026-02-03 · CVE-2025-37934

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue concerns a pointer check in the graph util parse link direction function within the Linux kernel's ASoC simple-card-utils. The problem arises when the function fails to validate the passed pointers before writing to them, potentially leading to invalid operations. This also addresses a UBSAN warning related to an invalid load in the imx-card.c file, caused by an uninitialized playback only variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BDU:2025-12327

CVE-2025-37934

SUSE-SU-2025:02254-1

SUSE-SU-2025:02307-1

SUSE-SU-2025:02333-1

SUSE-SU-2025_02254-1

SUSE-SU-2025_02307-1

SUSE-SU-2025_02333-1

USN-7649-1

USN-7649-2

USN-7650-1

USN-7665-1

USN-7665-2

USN-7721-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Suse

Ubuntu

References · 711

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37934.json · Exploit
• https://ubuntu.com/security/CVE-2025-37911 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37956 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37962 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38002 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37934 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-37934 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38006 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37991 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37949 · Vendor Advisory
• https://git.kernel.org/stable/c/9b5b3088c4d1752253491705919bd7d067964288 · Patch
• https://ubuntu.com/security/CVE-2025-38056 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37924 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37950 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38008 · Vendor Advisory