Security readout for executives and security teams
Plain-English summary
A Linux KVM flaw on Arm64 can use an uninitialized memory-cache pointer while mapping guest memory. On affected virtualization hosts, a locally privileged attacker may be able to compromise confidentiality, integrity, and availability beyond the vulnerable component. The supplied severity is high, but the sources do not document real-world exploitation.
Executive priority
Treat this as a high-priority virtualization-host update where Arm64 KVM is deployed, especially for multi-tenant or untrusted workloads. First establish whether affected 6.14-series kernels are running. There is no cited active exploitation, so urgency should be driven by exposure and potential cross-boundary impact rather than claims of an ongoing campaign.
Technical view
Commit fce886a60207 conditionally initialized memcache in KVM Arm64 user_mem_abort(). A path reaching kvm_pgtable_stage2_map() during stage-2 allocation could therefore use it uninitialized, particularly without a permission fault or dirty-logging transition. The resolution ensures memcache is always valid. CVSS 3.1 is 8.8: local, low complexity, low privileges, no user interaction, scope changed.
Likely exposure
Exposure is limited to Arm64 Linux systems using KVM and running an affected kernel containing the introducing change. The bundle identifies the Linux 6.14 line, but its structured version boundaries are ambiguous. Non-Arm64 systems and hosts not using KVM are unlikely to reach the described path.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The CVSS vector requires local access and low privileges. The precise attacker position, reachable security boundary, and practical reliability are not established by the bundle.
Researcher notes
The root cause is conditional initialization of a local memcache pointer introduced by fce886a60207. Relevant paths require stage-2 allocation and bypass initialization through permission-fault or dirty-logging transitions. The bundle does not establish deterministic impact, exploitability, affected distribution packages, or precise version intervals; confirm these against kernel and distribution advisories.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced upstream or stable correction.
- Check distribution advisories for exact affected and fixed package versions.
- Prioritize Arm64 KVM hosts running Linux 6.14-series kernels.
- Restrict untrusted local access and virtualization workloads until remediation is confirmed.
Validation and detection
- Inventory Arm64 hosts and confirm whether KVM is enabled or actively used.
- Record installed kernel versions and distribution package release identifiers.
- Verify the installed source or package includes one of the referenced corrective commits.
- After updating, reboot hosts and confirm the running kernel matches the remediated package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37996 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a26d50f8a4a5049e956984797b5d0dedea4bbb18CVE reference, Linux
- https://git.kernel.org/stable/c/157dbc4a321f5bb6f8b6c724d12ba720a90f1a7cCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.