LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result

In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command the driver might at the least print garbage and at the worst crash when the user runs the "devlink dev info" devlink command. This happens because the stack variable fw_list is not 0 initialized which results in fw_list.num_fw_slots being a garbage value from the stack. Then the driver tries to access fw_list.fw_names[i] with i >= ARRAY_SIZE and runs off the end of the array. Fix this by initializing the fw_list and by not failing completely if the devcmd fails because other useful information is printed via devlink dev info even if the devcmd fails.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local user on an affected Linux system may trigger faulty kernel-driver handling when requesting device information. With unsupported firmware, the driver can expose uninitialized stack data or crash the kernel, risking confidentiality and availability. The issue does not provide remote access or reported integrity impact.

Executive priority

Treat as a high-priority local kernel issue on systems using the affected driver, especially shared or multi-user hosts. Prioritize exposure identification and supported kernel updates. Internet-wide emergency action is not supported because the attack vector is local and active exploitation is unconfirmed.

Technical view

The pds_core driver leaves fw_list uninitialized when firmware rejects PDS_CORE_CMD_FW_CONTROL. A garbage num_fw_slots value can drive fw_names indexing beyond the array boundary during devlink device-information handling. The documented fix zero-initializes fw_list and preserves other information when the firmware command fails.

Likely exposure

Exposure requires an affected kernel, the pds_core driver, firmware lacking the relevant command, and local low-privileged access. The bundle lists several affected Linux versions, but its version data is irregular; distribution backports and exact fixed-release boundaries must be verified.

Exploitation context

The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. Potential outcomes are information disclosure and kernel failure. The bundle marks KEV false and provides no evidence of active exploitation, public weaponization, or remote exploitation.

Researcher notes

The supplied affected-version data includes an anomalous “0” entry and repeats one commit under an unaffected record. Do not infer precise vulnerable ranges solely from that list. Establish exposure through kernel commit ancestry, distribution backport records, driver presence, firmware behavior, and controlled testing.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable cited stable fix.
  • Check distribution advisories and kernel changelogs for backported remediation.
  • Restrict unnecessary local access while affected systems await updates.
  • Prioritize systems using pds_core with firmware that may reject the command.

Validation and detection

  • Inventory kernel versions and determine whether the pds_core driver is present or loaded.
  • Confirm whether installed kernels contain an applicable cited fix commit or vendor backport.
  • Review firmware compatibility and support for PDS_CORE_CMD_FW_CONTROL.
  • Avoid triggering the vulnerable query on production systems during validation.
  • Retest device-information reporting in a controlled environment after remediation.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37887 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2025-37887Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux45d76f492938cdc27ddadc16e1e75103f4cfbf56, 45d76f492938cdc27ddadc16e1e75103f4cfbf56, 45d76f492938cdc27ddadc16e1e75103f4cfbf56, 45d76f492938cdc27ddadc16e1e75103f4cfbf56unaffected
LinuxLinux6.4, 0, 6.6.89, 6.12.26, 6.14.5, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.