Security readout for executives and security teams
Plain-English summary
A race in the Linux HSI ssi_protocol driver can leave background work using memory after it has been freed during driver removal. A local, low-privileged attacker may be able to trigger a kernel crash or compromise confidentiality and integrity, but practical reachability depends on the driver being present and usable.
Executive priority
Prioritize affected multi-user or otherwise untrusted Linux systems where this uncommon driver is enabled. Treat confirmed reachable installations as high priority because successful exploitation could affect the entire host. Systems without the driver or required hardware path are likely lower urgency, but should be validated rather than assumed safe.
Technical view
During ssi_protocol_remove(), the driver frees its ssi structure while ssip_xmit_work() may still reference it on another CPU, causing a CWE-416 use-after-free. The upstream correction cancels the pending work before cleanup. CVSS 3.1 is 7.8: local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is concentrated on Linux systems with an affected ssi_protocol driver available and a reachable path to concurrent transmission work and driver removal. The supplied record lists affected releases across several kernel lines, but distribution backports can change status; kernel version strings alone are not conclusive.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation. The CVSS vector describes local, low-privileged access rather than remote exploitation. Triggering the flaw also depends on driver-specific activity and a cleanup race, which may limit real-world exposure.
Researcher notes
The critical race is between ssi_protocol_remove() freeing ssi and ssip_xmit_work() dereferencing ssi->cl. The stated fix synchronously cancels work before cleanup. The source bundle does not establish exploit reliability, required hardware details, or whether every listed release is vulnerable after downstream backports; assess exact kernel builds against vendor records or fix commits.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable stable fix.
- Confirm distribution advisories because vendors may backport fixes without changing major kernel versions.
- If updating is delayed, disable the unused ssi_protocol driver where operationally safe.
- Restrict local access and unnecessary module-management capability until remediation is verified.
Validation and detection
- Inventory running kernels and identify hosts where the ssi_protocol driver is built or installed.
- Determine whether the driver is loaded, used, or required by attached HSI hardware.
- Confirm the installed vendor kernel includes the applicable stable fix or documented backport.
- After updating, verify each host booted into the remediated kernel.
- Monitor kernel logs for driver faults or unexpected crashes during the remediation window.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-37838 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d03abc1c2b21324550fa71e12d53e7d3498e0af6CVE reference, Linux
- https://git.kernel.org/stable/c/4a8c29beb8a02b5a0a9d77d608aa14b6f88a6b86CVE reference, Linux
- https://git.kernel.org/stable/c/72972552d0d0bfeb2dec5daf343a19018db36ffaCVE reference, Linux
- https://git.kernel.org/stable/c/d58493832e284f066e559b8da5ab20c15a2801d3CVE reference, Linux
- https://git.kernel.org/stable/c/58eb29dba712ab0f13af59ca2fe545f5ce360e78CVE reference, Linux
- https://git.kernel.org/stable/c/ae5a6a0b425e8f76a9f0677e50796e494e89b088CVE reference, Linux
- https://git.kernel.org/stable/c/834e602d0cc7c743bfce734fad4a46cefc0f9ab1CVE reference, Linux
- https://git.kernel.org/stable/c/4b4194c9a7a8f92db39e8e86c85f4fb12ebbec4fCVE reference, Linux
- https://git.kernel.org/stable/c/e3f88665a78045fe35c7669d2926b8d97b892c11CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.