Security readout for executives and security teams
Plain-English summary
A flaw in Linux kernel tracing can let certain trace-event formats bypass a safety check. A locally authenticated, low-privilege user may be able to trigger access to freed kernel memory, potentially exposing sensitive information or crashing the system. Internet reachability alone does not create exposure.
Executive priority
Treat this as a high-priority operating-system maintenance issue, especially on shared hosts where untrusted users can run local code. It is not evidenced as an active or remote attack, so emergency internet isolation is unsupported. Schedule prompt patching through normal kernel change controls and verify systems booted into corrected kernels.
Technical view
The trace-event verifier failed to inspect formats using "%*p..". Such formats could dereference event data freed before a trace record is read, causing a use-after-free read. CVSS 3.1 is 7.1: local access, low complexity, low privileges, no user interaction, with high confidentiality and availability impact.
Likely exposure
Exposure is limited to Linux systems running an affected kernel with a reachable vulnerable tracing path. The source bundle identifies Linux kernel versions and several stable-branch correction commits, but does not provide reliable distribution-package mappings. Multi-user hosts, developer systems, containers sharing a host kernel, and systems loading third-party trace-event modules deserve closer review.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The CVSS vector requires local access and low privileges. Risk is therefore primarily post-access privilege-boundary impact, information exposure, and denial of service rather than unauthenticated remote compromise.
Researcher notes
The failure is in trace-event format verification: "%*p.." was ignored, allowing unsafe pointer dereferences to escape validation performed at boot or module load. The described consequence is reading memory after it has been freed, with possible kernel crash or disclosure. The correction covers this format case and adds a "%*pbl" sample. Exact triggerability by configuration is not documented here.
Mitigation direction
- Apply the kernel update recommended by the operating-system or kernel vendor.
- Confirm the selected update incorporates the applicable referenced stable-kernel correction.
- Prioritize shared, multi-user, development, and container-host systems.
- Reboot into the updated kernel according to vendor guidance.
- Monitor vendor advisories for distribution-specific package and backport details.
Validation and detection
- Inventory running kernel versions across Linux hosts and container hosts.
- Compare each kernel package with its distribution vendor's CVE guidance.
- Verify the running kernel changed after updating and rebooting.
- Confirm the applicable stable correction is present in custom kernels.
- Regression-test tracing and third-party kernel modules in staging.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37938 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/6854c87ac823181c810f8c07489ba543260c0023CVE reference, Linux
- https://git.kernel.org/stable/c/4d11fac941d83509be4e6a21038281d6d96da50cCVE reference, Linux
- https://git.kernel.org/stable/c/03127354027508d076073b020d3070990fd6a958CVE reference, Linux
- https://git.kernel.org/stable/c/04b80d45ecfaf780981d6582899e3ab205e4aa08CVE reference, Linux
- https://git.kernel.org/stable/c/c7204fd1758c0caf1938e8a59809a1fdf28a8114CVE reference, Linux
- https://git.kernel.org/stable/c/ea8d7647f9ddf1f81e2027ed305299797299aa03CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.