LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37886: pds_core: make wait_context part of q_info

In the Linux kernel, the following vulnerability has been resolved: pds_core: make wait_context part of q_info Make the wait_context a full part of the q_info struct rather than a stack variable that goes away after pdsc_adminq_post() is done so that the context is still available after the wait loop has given up. There was a case where a slow development firmware caused the adminq request to time out, but then later the FW finally finished the request and sent the interrupt. The handler tried to complete_all() the completion context that had been created on the stack in pdsc_adminq_post() but no longer existed. This caused bad pointer usage, kernel crashes, and much wailing and gnashing of teeth.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A timing flaw in the Linux pds_core driver can leave an interrupt handler using memory that disappeared after an administrative request timed out. A delayed firmware response may then cause invalid pointer use and a kernel crash. The supplied CVSS assessment also indicates possible confidentiality and integrity impact from a local, low-privileged attack context.

Executive priority

Treat as a high-priority reliability and privilege-boundary issue on systems using pds_core, especially critical hosts where a kernel crash causes material disruption. Patch through normal emergency kernel procedures after confirming vendor applicability. Broader fleets without this driver can be triaged behind demonstrably exposed systems.

Technical view

pdsc_adminq_post() stored a completion wait context on the stack. If the wait timed out before slow firmware completed the request, a later interrupt could call complete_all() against the expired context. The resolved design makes wait_context part of the persistent q_info structure, preventing this use-after-lifetime condition.

Likely exposure

Exposure is limited to Linux systems running an affected kernel with the relevant pds_core driver path in use. The bundle lists affected releases including 6.4, 6.6.89, 6.12.26, 6.14.5, and 6.15, but its version formatting is insufficient to establish complete affected ranges. Confirm status with the system's Linux distributor.

Exploitation context

The supplied CVSS vector describes local access, low privileges, low complexity, and no user interaction. The documented trigger involved slow development firmware and a late interrupt after timeout. The bundle reports no CISA KEV listing and provides no evidence of active exploitation or a public exploit.

Researcher notes

The source describes an expired stack completion context reached asynchronously by a late firmware interrupt. Stable commits are supplied, but the bundle does not clearly map each commit to every affected branch or provide complete version-range semantics. No CWE, workaround, public proof of concept, or observed exploitation is identified.

Mitigation direction

  • Install a vendor-supported kernel containing the referenced upstream stable fix.
  • Prioritize systems where the pds_core driver and associated hardware are actively used.
  • Reboot into the corrected kernel and verify the running version afterward.
  • If immediate updating is impossible, request supported interim guidance from the Linux distributor.

Validation and detection

  • Inventory running kernel versions and identify hosts loading or using pds_core.
  • Compare distributor package advisories and changelogs against CVE-2025-37886.
  • Confirm the installed kernel incorporates the applicable referenced stable commit.
  • Review kernel logs for administrative-queue timeouts, invalid pointer reports, or crashes.
  • After updating, verify systems booted successfully into the corrected kernel.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37886 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-37886Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux01ba61b55b2041a39c54aefb3153c770dd59a0ef, 01ba61b55b2041a39c54aefb3153c770dd59a0ef, 01ba61b55b2041a39c54aefb3153c770dd59a0ef, 01ba61b55b2041a39c54aefb3153c770dd59a0efunaffected
LinuxLinux6.4, 0, 6.6.89, 6.12.26, 6.14.5, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.