CVE-2025-37898 powerpc64/ftrace: fix module loading without patchable function entries
A flaw in the Linux kernel's powerpc64 ftrace module loading causes a denial of service when loading modules without patchable function entries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37898?
CVE-2025-37898 is a medium-severity denial of service vulnerability in Linux kernel, published on 20 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
powerpc64/ftrace: fix module loading without patchable function entries
get_stubs_size assumes that there must always be at least one patchable function entry, which is not always the case (modules that export data but no code), otherwise it returns -ENOEXEC and thus the section header sh_size is set to that value. During module_memory_alloc() the size is passed to execmem_alloc() after being page-aligned and thus set to zero which will cause it to fail the allocation (and thus module loading) as __vmalloc_node_range() checks for zero-sized allocs and returns null:
[ 115.466896] module_64: cast_common: doesn't contain __patchable_function_entries. [ 115.469189] ------------[ cut here ]------------ [ 115.469496] WARNING: CPU: 0 PID: 274 at mm/vmalloc.c:3778 __vmalloc_node_range_noprof+0x8b4/0x8f0 ... [ 115.478574] ---[ end trace 0000000000000000 ]--- [ 115.479545] execmem: unable to allocate memory
Fix this by removing the check completely, since it is anyway not helpful to propagate this as an error upwards.
Which versions are affected by CVE-2025-37898?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-37898?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-37898 being exploited?
There is no known exploitation of CVE-2025-37898 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-37898, GHSA-hc3m-pcgg-jv94, UBUNTU-CVE-2025-37898.