CVE-2025-37996 KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()
An uninitialized pointer in the Linux kernel KVM arm64 module can cause a crash, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37996?
CVE-2025-37996 is a high-severity vulnerability in Linux kernel, published on 29 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()
Commit fce886a60207 ("KVM: arm64: Plumb the pKVM MMU in KVM") made the initialization of the local memcache variable in user_mem_abort() conditional, leaving a codepath where it is used uninitialized via kvm_pgtable_stage2_map().
This can fail on any path that requires a stage-2 allocation without transition via a permission fault or dirty logging.
Fix this by making sure that memcache is always valid.
Weakness: CWE-908
Which versions are affected by CVE-2025-37996?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-37996?
Apply the vendor's patch.
Is CVE-2025-37996 being exploited?
There is no known exploitation of CVE-2025-37996 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-37996, GHSA-v8pp-m355-r6cw, UBUNTU-CVE-2025-37996.