Security readout for executives and security teams
Plain-English summary
A cleanup error in Linux KVM on Arm64 can leave virtual interrupt-controller data behind when virtual CPU creation fails. This may cause a memory leak or use-after-free, potentially compromising confidentiality, integrity, or availability. The issue matters primarily to Arm64 systems providing KVM virtualization, rather than ordinary internet-facing Linux servers.
Executive priority
Treat this as a high-priority infrastructure patch for Arm64 KVM hosts, especially multi-tenant systems. It is not presented as remotely exploitable or actively exploited, so prioritize by confirmed virtualization exposure and untrusted local access rather than applying emergency internet-edge response procedures.
Technical view
When kvm_arch_vcpu_create() cannot share a vCPU page with the hypervisor, it returns an error without destroying initialized vGIC vCPU structures. Later vCPU destruction leaks memory, while redistributor processing may traverse freed data. The kernel fix adds the missing vGIC teardown to the failed creation path.
Likely exposure
Exposure is concentrated on Arm64 Linux hosts using KVM and the virtual Generic Interrupt Controller. The bundle lists several kernel lines through 6.15 as affected, but does not provide clear distribution-package boundaries. Systems not using Arm64 KVM/vGIC are unlikely to reach the described path.
Exploitation context
The supplied CVSS is 8.8 and describes local, low-complexity exploitation requiring low privileges and no user interaction. The CVE is not listed in KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. Practical exploitability and required KVM access are not fully documented here.
Researcher notes
The key state transition is initialization of vGIC vCPU data followed by failure to share the vCPU page. Missing rollback leaves stale state reachable by redistributor handling. The sources identify memory leakage and use-after-free, but do not document a reliable trigger, demonstrated impact, exploit availability, or exact distribution package ranges.
Mitigation direction
- Install a vendor-supported kernel containing the referenced vGIC cleanup fix.
- Follow distribution guidance to identify the correct fixed kernel package.
- Restrict untrusted access to KVM virtualization interfaces until remediation is complete.
- Prioritize shared or multi-tenant Arm64 virtualization hosts.
Validation and detection
- Inventory Arm64 hosts, running kernels, and KVM virtualization usage.
- Compare installed kernel packages with current vendor security guidance.
- Confirm the deployed kernel includes the applicable referenced stable fix.
- Review which users and workloads can access KVM virtualization interfaces.
- After updating, verify hosts are running the intended fixed kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37849 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/07476e0d932afc53c05468076393ac35d0b4999eCVE reference, Linux
- https://git.kernel.org/stable/c/5085e02362b9948f82fceca979b8f8e12acb1cc5CVE reference, Linux
- https://git.kernel.org/stable/c/c322789613407647a05ff5c451a7bf545fb34e73CVE reference, Linux
- https://git.kernel.org/stable/c/2480326eba8ae9ccc5e4c3c2dc8d407db68e3c52CVE reference, Linux
- https://git.kernel.org/stable/c/f1e9087abaeedec9bf2894a282ee4f0d8383f299CVE reference, Linux
- https://git.kernel.org/stable/c/250f25367b58d8c65a1b060a2dda037eea09a672CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.