CVE-2025-37849Use After Free in Linux

Severity
7.8HIGHNVD
OSV5.5OSV3.2
EPSS
0.1%
top 82.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMay 9
Latest updateApr 17

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU data initialised. Note only does this leak the corresponding memory when the vCPU is destroyed but it can also lead to use-after-free if the redistributor device handling tries to walk into the vCPU. Add the missing cleanup to kvm_arch_v

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages12 packages

Also affects: Debian Linux 11.0

Patches

🔴Vulnerability Details

24
OSV
linux-gcp, linux-gcp-4.15, linux-gcp-fips vulnerabilities2026-04-06
OSV
linux-fips, linux-aws-fips vulnerabilities2026-04-02
OSV
linux, linux-aws, linux-aws-hwe, linux-kvm, linux-oracle vulnerabilities2026-04-02
OSV
linux-azure-6.8 vulnerabilities2026-03-25
OSV
linux-azure-fips vulnerabilities2026-03-04

📋Vendor Advisories

33
Ubuntu
Linux kernel (HWE) vulnerabilities2026-04-17
Ubuntu
Linux kernel (Azure) vulnerabilities2026-04-15
Ubuntu
Linux kernel (Azure) vulnerabilities2026-04-13
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities2026-04-09
Ubuntu
Linux kernel (Intel IoTG Real-time) vulnerabilities2026-04-09
CVE-2025-37849 — Use After Free in Linux | cvebase