Security readout for executives and security teams
Plain-English summary
A malformed, very short packet can make the Linux kernel’s synchronous PPP networking code read beyond the available packet data. The supplied CVSS score is 8.2 because remote, unauthenticated triggering may cause serious availability impact and limited confidentiality impact. Systems not using the affected PPP path are less likely to be exposed.
Executive priority
Treat as a high-priority kernel update, especially for network-facing systems using PPP. Schedule expedited remediation through normal kernel maintenance and reboot procedures. Exposure should be validated before emergency disruption because the vulnerable path is specific, and the supplied evidence does not show active exploitation.
Technical view
ppp_sync_txmung accessed initial skb data bytes without first confirming that the linear buffer contained enough data. An incoming packet with an empty payload could therefore cause an out-of-bounds access. Linux stable fixes add the missing bounds check before those bytes are read.
Likely exposure
Exposure is most likely on listed affected Linux kernels where the synchronous PPP processing path is present and reachable by untrusted traffic. The bundle lists affected releases from 2.6.12 through 6.15, with several stable-series boundaries, but does not provide enough distribution-specific information to determine every vulnerable package.
Exploitation context
The supplied vector describes remote, low-complexity, unauthenticated exploitation without user interaction. However, KEV is false and no cited evidence reports active exploitation. The sources establish an out-of-bounds access and potential availability and confidentiality effects, but do not establish reliable code execution.
Researcher notes
The vulnerability is an skb bounds-validation failure in ppp_sync_txmung involving packets with insufficient linear data, including an empty payload. No CWE is supplied. The public record provides multiple stable-tree fix commits, but this bundle does not map each commit to a precise distribution package or prove exploitation beyond the out-of-bounds condition.
Mitigation direction
- Install a vendor-supported kernel containing the cited Linux stable bounds-check fix.
- Use distribution advisories to identify the corrected package for each deployed kernel.
- Prioritize systems that use synchronous PPP or expose PPP processing to untrusted traffic.
- If immediate updating is impossible, consult vendor guidance for supported exposure-reduction measures.
Validation and detection
- Inventory running kernel versions and compare them with vendor CVE advisories.
- Confirm installed kernel packages explicitly include the CVE-2025-37749 fix.
- Determine whether synchronous PPP functionality is configured or operational on each system.
- Review kernel logs and monitoring for unexplained networking faults or crashes.
- Reboot into the corrected kernel and verify the running version after installation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37749 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H3.94.2LinuxVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/529401c8f12ecc35f9ea5d946d5a5596cf172b48CVE reference, Linux
- https://git.kernel.org/stable/c/de5a4f0cba58625e88b7bebd88f780c8c0150997CVE reference, Linux
- https://git.kernel.org/stable/c/99aa698dec342a07125d733e39aab4394b3b7e05CVE reference, Linux
- https://git.kernel.org/stable/c/b78f2b458f56a5a4d976c8e01c43dbf58d3ea2caCVE reference, Linux
- https://git.kernel.org/stable/c/fbaffe8bccf148ece8ad67eb5d7aa852cabf59c8CVE reference, Linux
- https://git.kernel.org/stable/c/b4c836d33ca888695b2f2665f948bc1b34fbd533CVE reference, Linux
- https://git.kernel.org/stable/c/1f6eb9fa87a781d5370c0de7794ae242f1a95ee5CVE reference, Linux
- https://git.kernel.org/stable/c/6e8a6bf43cea4347121ab21bb1ed8d7bef7e732eCVE reference, Linux
- https://git.kernel.org/stable/c/aabc6596ffb377c4c9c8f335124b92ea282c9821CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.