Security readout for executives and security teams
Plain-English summary
A Linux 9p client can mishandle a server response that reports success with a negative byte count. The malformed reply may trigger a null-pointer dereference and crash the affected system. Risk is concentrated where Linux systems use 9p file sharing and connect to a faulty or hostile 9p server.
Executive priority
Treat patching as urgent for systems using 9p with remotely controlled or untrusted servers. Other Linux systems have lower immediate exposure because the vulnerable path depends on 9p use. Do not infer confirmed compromise from severity alone; no active exploitation is established in the supplied evidence.
Technical view
The affected p9_client_write() and p9_client_read_once() paths compared signed read or write counts with positive response sizes. A negative count could incorrectly pass validation, leading to unsafe processing and a null-pointer dereference. The kernel fix makes the relevant variables unsigned, causing the bogus count to be rejected.
Likely exposure
Exposure requires use of the Linux 9p client and receipt of a crafted or erroneous reply from a 9p server. The supplied affected-version list is ambiguous and should not be interpreted as a complete version range. Confirm exposure through kernel commit ancestry and distribution advisories.
Exploitation context
The supplied CVSS is 9.8 and describes network-reachable exploitation without privileges or user interaction. However, the public description demonstrates a null-pointer dereference, not confidentiality or integrity impact. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation. A reproducer is mentioned only as validation evidence.
Researcher notes
The key condition is a nominally successful RREAD or RWRITE carrying a negative count. Signed comparison allowed that value to appear within a positive response size. After conversion to unsigned, -1 becomes 4294967295 and fails validation. Evidence directly supports crash potential; broader confidentiality and integrity consequences remain unsubstantiated by the supplied sources.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable cited stable fix.
- Consult the Linux distribution advisory to map the fix to packaged kernel versions.
- Prioritize systems that mount or communicate with untrusted 9p servers.
- Until updated, reduce unnecessary 9p server connectivity where operationally feasible.
Validation and detection
- Inventory systems using the Linux 9p client or mounted 9p filesystems.
- Compare running kernel builds with vendor advisories and cited stable commits.
- Confirm the installed kernel package includes the signed-count handling fix.
- Review kernel logs for 9p errors, crashes, or null-pointer dereferences.
- Verify patched systems reject bogus negative counts without crashing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37879 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/468ff4a7c61fb811c596a7c44b6a5455e40fd12bCVE reference, Linux
- https://git.kernel.org/stable/c/a68768e280b7d0c967ea509e791bb9b90adc94a5CVE reference, Linux
- https://git.kernel.org/stable/c/c548f95688e2b5ae0e2ae43d53cf717156c7d034CVE reference, Linux
- https://git.kernel.org/stable/c/374e4cd75617c8c2552f562f39dd989583f5c330CVE reference, Linux
- https://git.kernel.org/stable/c/d0259a856afca31d699b706ed5e2adf11086c73bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.