cbcvebase.
CVE-2025-37916
published 2025-05-20

CVE-2025-37916: In the Linux kernel, the following vulnerability has been resolved: pds_core: remove write-after-free of client_id A use-after-free error popped up in stress…

PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.17%
6.8th percentile
In the Linux kernel, the following vulnerability has been resolved: pds_core: remove write-after-free of client_id A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47): [Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0x70 [Mon Apr 21 21:21:33 2025] device_release_driver_internal+0x11f/0x180 [Mon Apr 21 21:21:33 2025] driver_detach+0x45/0x80 [Mon Apr 21 21:21:33 2025] bus_remove_driver+0x83/0xe0 [Mon Apr 21 21:21:33 2025] pci_unregister_driver+0x1a/0x80 The actual device uninit usually happens on a separate thread scheduled after this code runs, but there is no guarantee of order of thread execution, so this could be a problem. There's no actual need to clear the client_id at this point, so simply remove the offending code.

Affected

25 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.12.29-1 (forky)linux 6.12.29-1 (forky)
linuxlinux
linuxlinux>= 10659034c622738bc1bfab8a76fc576c52d5acce < 9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b
linuxlinux>= 10659034c622738bc1bfab8a76fc576c52d5acce < c649b9653ed09196e91d3f4b16b679041b3c42e6c649b9653ed09196e91d3f4b16b679041b3c42e6
linuxlinux>= 10659034c622738bc1bfab8a76fc576c52d5acce < 26dc701021302f11c8350108321d11763bd81dfe26dc701021302f11c8350108321d11763bd81dfe
linuxlinux>= 10659034c622738bc1bfab8a76fc576c52d5acce < dfd76010f8e821b66116dec3c7d90dd2403d1396dfd76010f8e821b66116dec3c7d90dd2403d1396
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.12.29-16.12.29-1
linuxlinux_kernel>= 0 < 6.12.29-16.12.29-1
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 0 < 6.14.0-24.246.14.0-24.24
linuxlinux_kernel>= 6.13 < 6.14.66.14.6
linuxlinux_kernel>= 6.4 < 6.6.906.6.90
linuxlinux_kernel>= 6.7 < 6.12.286.12.28
msrcazl3_kernel_6.6.85.1-4_on_azure_linux_3.0
msrcazl3_kernel_6.6.92.2-1_on_azure_linux_3.0
ubuntulinux-aws
ubuntulinux-aws-6.8
ubuntulinux-gkeop
ubuntulinux-nvidia
ubuntulinux-nvidia-6.8
ubuntulinux-oracle
ubuntulinux-oracle-6.8
ubuntulinux-raspi-realtime
ubuntulinux-realtime

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.