CVE-2025-37974 s390/pci: Fix missing check for zpci_create_device() error return

What is CVE-2025-37974?

CVE-2025-37974 is a medium-severity vulnerability in Linux kernel, published on 20 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

s390/pci: Fix missing check for zpci_create_device() error return

The zpci_create_device() function returns an error pointer that needs to be checked before dereferencing it as a struct zpci_dev pointer. Add the missing check in __clp_add() where it was missed when adding the scan_list in the fixed commit. Simply not adding the device to the scan list results in the previous behavior.

Weakness: CWE-476

Which versions are affected by CVE-2025-37974?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2025-37974?

Apply the vendor's patch.

Is CVE-2025-37974 being exploited?

There is no known exploitation of CVE-2025-37974 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2025-37974, DEBIAN-CVE-2025-37974, GHSA-x674-mfwp-gm8v, ROOT-OS-UBUNTU-2404-CVE-2025-37974, UBUNTU-CVE-2025-37974.