Security readout for executives and security teams
Plain-English summary
A flaw in Linux ext4 extended-attribute cleanup can read memory after it has been freed. A local user may be able to crash the system or potentially affect confidentiality and integrity. The supplied evidence demonstrates the memory-safety failure but does not establish real-world exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially on multi-user Linux systems using ext4. It is not evidenced as an internet-exploited emergency, but the stated potential impact spans confidentiality, integrity, and availability. Patch through normal expedited kernel-update procedures after validating vendor applicability.
Technical view
During inode deletion, ext4_xattr_inode_dec_ref_all may process extended-attribute entries beyond the logical end marker, causing a slab use-after-free. KASAN detected a four-byte read through the unlink and inode-eviction path. The upstream correction ignores entries past the end entry.
Likely exposure
Exposure is limited to Linux systems running an affected kernel and using ext4 in the relevant extended-attribute deletion path. The supplied version list is ambiguous, so confirm applicability through distribution advisories or exact fix-commit ancestry. Systems not using ext4 are outside the described path.
Exploitation context
The CVSS 3.1 vector is 7.8 with local access, low complexity, low privileges, and no user interaction. KEV status is false, and the supplied sources provide no evidence of active exploitation. The report comes from a KASAN-assisted reproducer, not a documented attack campaign.
Researcher notes
The evidence identifies an out-of-bounds logical traversal leading to slab use-after-free in ext4_xattr_inode_dec_ref_all during inode eviction. No CWE is assigned in the bundle. The demonstrated access is a read, while broader impact derives from the supplied CVSS assessment; exploitability beyond the reproducer remains unconfirmed.
Mitigation direction
- Install the Linux kernel or distribution security update containing the applicable upstream ext4 fix.
- Use distribution advisories to map packaged kernel versions to the referenced stable-branch fixes.
- Prioritize shared systems where low-privileged local users can create and delete files on ext4.
- If patching is delayed, reduce untrusted local access and monitor affected hosts for abnormal kernel failures.
Validation and detection
- Inventory running kernel versions and identify mounted ext4 filesystems.
- Compare each kernel package against vendor advisories and the referenced upstream fix commits.
- Confirm patched hosts booted into the updated kernel, not merely installed it.
- Review kernel logs for KASAN reports, use-after-free messages, ext4 errors, or unexplained crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37738 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6aff941cb0f7d0c897c3698ad2e30672709135e3CVE reference, Linux
- https://git.kernel.org/stable/c/76c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3CVE reference, Linux
- https://git.kernel.org/stable/c/f737418b6de31c962c7192777ee4018906975383CVE reference, Linux
- https://git.kernel.org/stable/c/cf9291a3449b04688b81e32621e88de8f4314b54CVE reference, Linux
- https://git.kernel.org/stable/c/362a90cecd36e8a5c415966d0b75b04a0270e4ddCVE reference, Linux
- https://git.kernel.org/stable/c/eb59cc31b6ea076021d14b04e7faab1636b87d0eCVE reference, Linux
- https://git.kernel.org/stable/c/3bc6317033f365ce578eb6039445fb66162722fdCVE reference, Linux
- https://git.kernel.org/stable/c/836e625b03a666cf93ff5be328c8cb30336db872CVE reference, Linux
- https://git.kernel.org/stable/c/c8e008b60492cf6fd31ef127aea6d02fd3d314cdCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.