Security readout for executives and security teams
Plain-English summary
CVE-2025-37860 is a Linux kernel availability issue in the sfc network driver path. A NULL pointer dereference can occur because code tries to use the network device before it is created. The published impact is denial of service, not data theft or privilege escalation.
Executive priority
Treat as moderate priority. The business risk is service disruption on affected Linux hosts, not confirmed compromise. Patch through normal kernel maintenance, with faster handling for infrastructure that relies on the affected driver path.
Technical view
The flaw is CWE-476 in ef100_process_design_param(). ef100_probe_main() and ef100_check_design_params() can run before efx->net_dev exists, making netif_set_tso_max_size() and netif_set_tso_max_segs() unsafe at that point. Stable fixes move those calls to ef100_probe_netdev() and replace netif_err with pci_err in design-parameter handling.
Likely exposure
Exposure appears limited to Linux systems running affected kernel builds with the affected sfc ef100 driver code path present. The bundle lists Linux 6.x affected versions but does not provide distribution-specific package names, hardware requirements, or complete version-range semantics.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high availability impact. KEV is false in the source bundle, and no cited source reports active exploitation. Evidence supports denial-of-service risk only.
Researcher notes
Source evidence is narrow and kernel-specific. The fix rationale identifies an initialization-order bug around efx->net_dev lifetime. The bundle does not include exploit reports, distro advisories, hardware mapping, or precise affected-version range logic beyond the listed Linux entries.
Mitigation direction
- Update to a kernel build containing the referenced stable fixes.
- Check distribution vendor advisories for fixed kernel package availability.
- Prioritize systems that load or depend on the sfc driver path.
- Do not deploy affected kernel builds to relevant network-driver hosts.
- Track remediation through normal kernel patch management.
Validation and detection
- Inventory Linux kernel versions against the affected versions in the CVE bundle.
- Confirm whether the sfc driver is present or loaded on target systems.
- Verify installed kernels include one of the referenced stable commits or vendor backports.
- Run existing regression tests for network availability after kernel updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-37860 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f21623b8446735b5e2ac5f8ee69b8743177d7b19CVE reference, Linux
- https://git.kernel.org/stable/c/e56391011381d6d029da377a65ac314cb3d5def2CVE reference, Linux
- https://git.kernel.org/stable/c/8241ecec1cdc6699ae197d52d58e76bddd995fa5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.