Security readout for executives and security teams
Plain-English summary
A Linux kernel defect can read beyond the end of an AMD processor erratum table because its terminating NULL entry was accidentally removed. The supplied CVSS rates potential confidentiality and availability impact as high, but exploitation requires local access with low privileges.
Executive priority
Treat as a high-priority kernel maintenance issue, especially on shared Linux infrastructure. It is not supported as an internet-remote or actively exploited emergency, but local low-privilege access could threaten sensitive data and system availability.
Technical view
The conversion from x86_cpu_desc to x86_cpu_id removed the NULL terminator from erratum_1386_microcode. Readers can consequently continue beyond the array boundary. CVSS 3.1 is 7.1: local, low-complexity, low-privilege exploitation; no user interaction; high confidentiality and availability impact; no stated integrity impact.
Likely exposure
The supplied affected data identifies Linux kernel versions 6.14, 6.14.3, and 6.15, but its range semantics are incomplete. Exposure is most relevant where the x86 AMD erratum lookup is exercised. Confirm exact distribution kernel builds and backports with the vendor.
Exploitation context
The supplied record does not establish active exploitation, and the CVE is not listed as KEV in the bundle. The CVSS vector requires local access and low privileges, limiting remote exposure but making multi-user systems, shared infrastructure, and compromised workloads more concerning.
Researcher notes
The root cause is a missing sentinel in erratum_1386_microcode, producing an out-of-bounds array read. The bundle provides two stable-kernel fix references but does not provide crash traces, affected hardware models, exploit evidence, or reliable version-range notation. Distribution backport analysis is therefore essential.
Mitigation direction
- Install a vendor-supported kernel containing the referenced stable fix.
- Consult distribution advisories for backported fixes and exact affected build ranges.
- Prioritize shared or multi-user x86 systems where local untrusted code can run.
- Reduce local access for untrusted users until affected kernels are remediated.
Validation and detection
- Inventory kernel versions across Linux hosts and compare them with vendor advisories.
- Determine whether deployed kernels include either referenced stable fix commit.
- Identify x86 systems where the AMD erratum lookup may execute.
- After updating, verify the running kernel matches the remediated package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37751 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1b518f73f1b6f59e083ec33dea22d9a1a275a970CVE reference, Linux
- https://git.kernel.org/stable/c/f0df00ebc57f803603f2a2e0df197e51f06fbe90CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.