CVE-2025-37886 (GCVE-0-2025-37886)
Vulnerability from cvelistv5
Published
2025-05-09 06:45
Modified
2026-08-05 11:58
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: pds_core: make wait_context part of q_info Make the wait_context a full part of the q_info struct rather than a stack variable that goes away after pdsc_adminq_post() is done so that the context is still available after the wait loop has given up. There was a case where a slow development firmware caused the adminq request to time out, but then later the FW finally finished the request and sent the interrupt. The handler tried to complete_all() the completion context that had been created on the stack in pdsc_adminq_post() but no longer existed. This caused bad pointer usage, kernel crashes, and much wailing and gnashing of teeth.
References
Impacted products
Vendor Product Version
Linux Linux Version: 01ba61b55b2041a39c54aefb3153c770dd59a0ef
Version: 01ba61b55b2041a39c54aefb3153c770dd59a0ef
Version: 01ba61b55b2041a39c54aefb3153c770dd59a0ef
Version: 01ba61b55b2041a39c54aefb3153c770dd59a0ef
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/adminq.c",
            "drivers/net/ethernet/amd/pds_core/core.c",
            "drivers/net/ethernet/amd/pds_core/core.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381",
              "status": "affected",
              "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
              "versionType": "git"
            },
            {
              "lessThan": "66d7702b42ffdf0dce4808626088268a4e905ca6",
              "status": "affected",
              "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
              "versionType": "git"
            },
            {
              "lessThan": "520f012fe75fb8efc9f16a57ef929a7a2115d892",
              "status": "affected",
              "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
              "versionType": "git"
            },
            {
              "lessThan": "3f77c3dfffc7063428b100c4945ca2a7a8680380",
              "status": "affected",
              "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/adminq.c",
            "drivers/net/ethernet/amd/pds_core/core.c",
            "drivers/net/ethernet/amd/pds_core/core.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.89",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: make wait_context part of q_info\n\nMake the wait_context a full part of the q_info struct rather\nthan a stack variable that goes away after pdsc_adminq_post()\nis done so that the context is still available after the wait\nloop has given up.\n\nThere was a case where a slow development firmware caused\nthe adminq request to time out, but then later the FW finally\nfinished the request and sent the interrupt.  The handler tried\nto complete_all() the completion context that had been created\non the stack in pdsc_adminq_post() but no longer existed.\nThis caused bad pointer usage, kernel crashes, and much wailing\nand gnashing of teeth."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The AdminQ is a host control-plane queue with no packet-driven path; reaching it requires local access to a device handle \u2014 `/dev/fwctl/fwctlN` (`FWCTL_RPC`), a VFIO-assigned pds VF, or a vhost-vdpa node. No remote or adjacent-network actor can post AdminQ commands.\nAC:L - The attacker creates the required condition rather than waiting for it: fwctl RPCs let userspace choose arbitrary long-running firmware operations, and the 16-entry FW backing queue is trivially congested (documented in sibling commit d9e2f070d8af6) so commands exceed the 5s timeout while still completing later. Once the timeout fires there is no window to win \u2014 the stack frame is already dead and the attacker can groom it at leisure before the completion lands.\nPR:L - The fwctl `FWCTL_RPC_CONFIGURATION`/`DEBUG_READ_ONLY` scopes require no capability whatsoever (only file access to the char device), and VFIO/vhost-vdpa device nodes are routinely granted to unprivileged VMM and management users. No real root in the init namespace is needed.\nUI:N - The attacker posts the AdminQ command and the corruption occurs asynchronously from the driver\u0027s own workqueue when the firmware completes; no victim action is involved at any point.\nS:U - The stale-stack write and completion abuse occur entirely within the host kernel, the same security authority as the vulnerable driver. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:H - The dangling `q_info-\u003edest` write places 16 bytes of firmware-supplied data into a reused kernel stack frame whose subsequent occupant the attacker chooses, and the stale-completion list walk yields arbitrary-pointer dereference primitives that can be leveraged for kernel memory disclosure.\nI:H - This is a 16-byte device-controlled write to a freed stack frame plus `complete_all()` on a stale `struct completion` \u2014 writing `UINT_MAX` and traversing/waking an swait list built from attacker-groomed stack bytes, which is an arbitrary-write and control-flow-hijack primitive.\nA:H - The fix commit explicitly reports \"bad pointer usage, kernel crashes\"; additionally, acquiring a raw spinlock at a stale stack address can hang the AdminQ workqueue indefinitely, and the condition is repeatable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:03.678Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381"
        },
        {
          "url": "https://git.kernel.org/stable/c/66d7702b42ffdf0dce4808626088268a4e905ca6"
        },
        {
          "url": "https://git.kernel.org/stable/c/520f012fe75fb8efc9f16a57ef929a7a2115d892"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f77c3dfffc7063428b100c4945ca2a7a8680380"
        }
      ],
      "title": "pds_core: make wait_context part of q_info",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37886",
    "datePublished": "2025-05-09T06:45:48.810Z",
    "dateReserved": "2025-04-16T04:51:23.963Z",
    "dateUpdated": "2026-08-05T11:58:03.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.