Security readout for executives and security teams
Plain-English summary
A Linux kernel built with network filesystem support enabled but /proc filesystem support disabled can crash during startup or early file access. This unusual configuration limits broad exposure, but affected appliances, embedded systems, and custom kernels may suffer a serious availability failure.
Executive priority
Treat confirmed matching configurations as high-priority reliability risks because they may prevent normal startup or execution. For systems with CONFIG_PROC_FS enabled, urgency is lower; document the configuration evidence and follow normal kernel patch governance.
Technical view
netfs initialization attempts to create /proc/fs/netfs when CONFIG_PROC_FS is disabled. That failure enters an incorrect initialization path, later producing a kernel BUG during netfs request allocation. The upstream correction conditionally creates the procfs entry only when CONFIG_PROC_FS is enabled.
Likely exposure
Exposure appears limited to affected Linux versions using the specific combination CONFIG_NETFS_SUPPORTS=y and CONFIG_PROC_FS=n. Conventional distribution kernels commonly enable procfs, but the supplied sources do not establish which vendor builds use this configuration.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. Its example demonstrates a configuration-dependent kernel crash. The CVSS vector describes local, high-complexity access requiring low privileges, although the disclosed failure occurs during system initialization.
Researcher notes
The disclosure establishes a reproducible kernel crash and identifies the faulty procfs creation path. It does not demonstrate confidentiality or integrity compromise despite the supplied CVSS 7.0 vector rating all three impacts High. Exact vulnerable-to-fixed version boundaries and vendor package mappings are incomplete in the bundle.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix.
- Check vendor advisories for fixed package versions before deployment.
- Avoid CONFIG_NETFS_SUPPORTS=y with CONFIG_PROC_FS=n until the fix is applied.
- Prioritize custom, embedded, appliance, and minimized kernel builds for review.
Validation and detection
- Inspect deployed kernel configurations for CONFIG_NETFS_SUPPORTS=y and CONFIG_PROC_FS=n.
- Confirm installed kernel packages include the applicable stable commit or vendor backport.
- Boot representative affected configurations in an isolated test environment and check for kernel BUG messages.
- Verify netfs workloads operate normally after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37876 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2ef6eea2efce01d1956ace483216f6b6e26330c9CVE reference, Linux
- https://git.kernel.org/stable/c/6c4c5e0b96a90f2a11c378e66edc1f25165e10b6CVE reference, Linux
- https://git.kernel.org/stable/c/40cb48eba3b4b79e110c1a35d33a48cac54507a2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.