Security readout for executives and security teams
Plain-English summary
A memory-lifetime error in the Linux PowerVR graphics driver can let a paired geometry job be freed while a fragment job still uses it. This creates a local use-after-free condition. The supplied CVSS assessment rates potential confidentiality, integrity, and availability impact as high.
Executive priority
Treat as a high-priority kernel maintenance issue on exposed PowerVR systems, especially shared endpoints or compute hosts with untrusted local users. It is less urgent for systems without the relevant driver. No supplied evidence supports emergency incident response for active exploitation.
Technical view
The drm/imagination scheduler failed to retain a reference from a fragment job to its paired geometry job. During pvr_queue_prepare_job, the scheduler could access the already-freed geometry-job structure. The fix adds the paired reference, preserving the object until the fragment job finishes. KASAN detected the flaw as a slab use-after-free.
Likely exposure
Exposure is limited to Linux systems running an affected kernel with the Imagination PowerVR driver relevant and accessible. The supplied version data identifies 6.8, 6.12.25, 6.14.4, and 6.15 but includes ambiguous entries; confirm exact distribution package status with the vendor.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The source bundle does not place this CVE in KEV and provides no evidence of active exploitation or a public exploit. Practical exploitability is not established by the supplied evidence.
Researcher notes
The vulnerable path involves paired geometry and fragment jobs. The geometry object remained reachable during fragment-job preparation without a corresponding lifetime reference. KASAN observed a one-byte read after free in pvr_queue_prepare_job. The bundle does not establish reliable exploitation primitives, affected hardware breadth, or the consequence beyond the CVSS assessment.
Mitigation direction
- Apply a vendor-supported kernel update that incorporates the referenced stable fix.
- Check distribution security guidance for corrected package versions and backports.
- Prioritize systems where the Imagination PowerVR driver is present and usable by untrusted local users.
- Restrict unnecessary local account or workload access while awaiting the vendor update.
Validation and detection
- Inventory kernel versions and determine whether the Imagination PowerVR driver is installed or active.
- Verify the installed kernel package includes the referenced fix or an equivalent vendor backport.
- Review vendor advisories because upstream version metadata may not match distribution package versions.
- Regression-test affected graphics workloads after updating.
- Monitor kernel logs for KASAN or scheduler faults involving pvr_queue_prepare_job or powervr.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37763 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c90b95e12eb88d23740e5ea2c43d71675d17ac8dCVE reference, Linux
- https://git.kernel.org/stable/c/b5a6f97a78e2fc008fd6503b7040cb7e1120b873CVE reference, Linux
- https://git.kernel.org/stable/c/4ba2abe154ef68f9612eee9d6fbfe53a1736b064CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.