Security readout for executives and security teams
Plain-English summary
A race in the Linux AMD GPU compute driver can corrupt memory and crash the driver during recovery from a hung hardware scheduler. Exploitation requires local, low-privileged access and the affected reset sequence, so it is not a direct remote threat. Successful abuse could compromise confidentiality, integrity, and availability according to the supplied CVSS assessment.
Executive priority
Treat this as a high-priority local kernel issue on AMD GPU compute systems, especially shared or multi-user hosts. Accelerate vendor kernel updates where low-privileged users can submit GPU workloads. Systems without AMD KFD use are unlikely to reach the described path, but exact exposure should be confirmed through inventory and vendor build mapping.
Technical view
During an AMD KFD mode1 reset, user GPU queues may continue accessing system memory while cleanup frees memory and VRAM. Reallocation of that memory creates a use-after-free race, allowing queue writes to corrupt reused kernel data. The fix terminates user queues, waits for ongoing reset work to complete, and only then frees outstanding buffer objects.
Likely exposure
Exposure is concentrated on systems running affected Linux kernels with AMD KFD functionality in use. The vulnerable path requires a hardware-scheduler hang followed by mode1 reset while user queues remain active. The supplied version list is ambiguous, so administrators should map their exact distribution kernel build against vendor guidance and the referenced stable fixes.
Exploitation context
The CVSS 3.1 vector scores this 7.8: local access, low complexity, low privileges, and no user interaction, with potentially high impact. The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. Internet exposure alone does not make this directly remotely exploitable.
Researcher notes
The flaw is a timing-dependent use-after-free in reset and cleanup ordering. The trigger conditions narrow practical exposure, but kernel-memory corruption makes the potential impact serious. The normalized affected-version data repeats an introducing commit and mixes release numbers without clear fixed boundaries; use upstream commits and distribution advisories to determine build-level status.
Mitigation direction
- Update to a vendor-supported kernel build containing the referenced AMD KFD race fix.
- Confirm distribution backport status rather than relying solely on upstream kernel version numbers.
- Prioritize multi-user AMD GPU compute hosts where untrusted local users can access GPU resources.
- If patching is delayed, consult vendor guidance for supported exposure-reduction measures.
Validation and detection
- Inventory Linux kernel builds on systems using AMD KFD GPU functionality.
- Verify the distribution kernel changelog or advisory explicitly includes CVE-2025-37854.
- Confirm the applicable stable fix commit is present in custom or vendor kernel sources.
- Review driver crash records for AMD KFD failures associated with scheduler hangs or mode1 resets.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37854 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/57c9dabda80ac167de8cd71231baae37cc2f442dCVE reference, Linux
- https://git.kernel.org/stable/c/89af6b39f028c130d4362f57042927f005423e6aCVE reference, Linux
- https://git.kernel.org/stable/c/ffd37d7d44d7e0b6e769d4fe6590e327f8cc3951CVE reference, Linux
- https://git.kernel.org/stable/c/6f30a847432cae84c7428e9b684b3e3fa49b2391CVE reference, Linux
- https://git.kernel.org/stable/c/9c4bcdf4068aae3e17e31c144300be405cfa03ffCVE reference, Linux
- https://git.kernel.org/stable/c/f0b4440cdc1807bb6ec3dce0d6de81170803569bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.