CVE-2025-37880 um: work around sched_yield not yielding in time-travel mode
A flaw in the Linux kernel's User Mode Linux time-travel mode can cause extreme slowdowns or deadlocks when userspace processes use sched_yield.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37880?
CVE-2025-37880 is a medium-severity denial of service vulnerability in Linux kernel, published on 9 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
um: work around sched_yield not yielding in time-travel mode
sched_yield by a userspace may not actually cause scheduling in time-travel mode as no time has passed. In the case seen it appears to be a badly implemented userspace spinlock in ASAN. Unfortunately, with time-travel it causes an extreme slowdown or even deadlock depending on the kernel configuration (CONFIG_UML_MAX_USERSPACE_ITERATIONS).
Work around it by accounting time to the process whenever it executes a sched_yield syscall.
Weakness: CWE-667
Which versions are affected by CVE-2025-37880?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-37880?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-37880 being exploited?
There is no known exploitation of CVE-2025-37880 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-37880, DEBIAN-CVE-2025-37880, GHSA-v3qr-5fr6-xpwv, ROOT-OS-DEBIAN-11-CVE-2025-37880, ROOT-OS-DEBIAN-12-CVE-2025-37880, ROOT-OS-DEBIAN-13-CVE-2025-37880 and 3 more.