Security readout for executives and security teams
Plain-English summary
A race condition in the Linux mpi3mr storage-controller driver can make one kernel thread use a reply queue while another resets it. The resulting invalid queue reference can access unallocated memory and crash the system, disrupting storage-dependent services. Exploitation requires local access according to the supplied CVSS vector.
Executive priority
Treat this as a high-priority reliability and host-security update for affected storage servers. Prioritize systems whose outage would disrupt critical services. Broad emergency action is not supported because exploitation is local, exposure depends on mpi3mr use, and no active exploitation evidence is supplied.
Technical view
Reset and task-management threads can concurrently process mpi3mr reply queues. During reset, a queue ID becomes 0xFFFF; another thread may use that invalid ID and reference unallocated memory. The upstream fix introduces io_admin_reset_sync, blocks I/O and administrative processing during reset, waits up to ten seconds for in-flight work, and marks the controller unrecoverable on timeout.
Likely exposure
Exposure is limited to Linux systems using the mpi3mr SCSI driver and an affected kernel build. The supplied affected-version data lists 5.14, 6.12.24, 6.13.12, 6.14.3, and 6.15, but does not clearly define complete vulnerable ranges. Distribution backports may change actual status.
Exploitation context
The CVSS 3.1 score is 7.8 with local, low-complexity, low-privilege access and no user interaction. The documented outcome is a kernel crash. The source bundle reports that this CVE is not in KEV and provides no evidence of active exploitation or a public exploit.
Researcher notes
The concrete failure described is invalid memory access and system crash during concurrent reset and task-management processing. Although the CVSS vector assigns high confidentiality, integrity, and availability impacts, the supplied narrative does not independently demonstrate data disclosure or modification. Duplicated commit hashes and unclear version boundaries reduce precision; verify downstream backports.
Mitigation direction
- Prioritize kernel updates containing the cited mpi3mr synchronization fix or an equivalent distribution backport.
- Check Linux distribution or system-vendor guidance for exact fixed package versions.
- Apply normal storage-service maintenance and recovery controls before rebooting into an updated kernel.
- Where updates are delayed, restrict local access and closely monitor affected storage hosts.
Validation and detection
- Inventory kernel versions on systems using the mpi3mr driver.
- Confirm whether each installed kernel contains one of the cited fixes or a documented backport.
- Review vendor advisories because the supplied version boundaries are incomplete.
- After updating, verify the expected kernel is running and storage controllers operate normally.
- Review kernel logs for mpi3mr resets, crashes, invalid queues, or unrecoverable-controller events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37861 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/65ba18c84dbd03afe9b38c06c151239d97a09834CVE reference, Linux
- https://git.kernel.org/stable/c/8d310d66e2b0f5f9f709764641647e8a3a4924faCVE reference, Linux
- https://git.kernel.org/stable/c/75b67dca4195e11ccf966a704787b2aa2754a457CVE reference, Linux
- https://git.kernel.org/stable/c/f195fc060c738d303a21fae146dbf85e1595fb4cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.