CyberSecBulletin
CVE-2025-37780NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2025-37780 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions ee01a309ebf598be1ff8174901ed6e91619f1749, 5e7de55602c61c8ff28db075cc49c8dd6989d7e0, 63d5a3e207bf315a32c7d16de6c89753a759f95a as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.22% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to ee01a309ebf598be1ff8174901ed6e91619f1749 or 5e7de55602c61c8ff28db075cc49c8dd6989d7e0 or 63d5a3e207bf315a32c7d16de6c89753a759f95a or 0fdafdaef796816a9ed0fd7ac812932d569d9beb, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.293 or 5.10.237 or 5.15.181 or 6.1.135, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, ee01a309ebf598be1ff8174901ed6e91619f1749; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 5e7de55602c61c8ff28db075cc49c8dd6989d7e0; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 63d5a3e207bf315a32c7d16de6c89753a759f95a; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 0fdafdaef796816a9ed0fd7ac812932d569d9beb; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 952e7a7e317f126d0a2b879fc531b716932d5ffa; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 56dfffea9fd3be0b3795a9ca6401e133a8427e0b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 007124c896e7d4614ac1f6bd4dedb975c35a2a8e; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 0405d4b63d082861f4eaff9d39c78ee9dc34f845; and 1 more rangesee01a309ebf598be1ff8174901ed6e91619f1749, 5e7de55602c61c8ff28db075cc49c8dd6989d7e0, 63d5a3e207bf315a32c7d16de6c89753a759f95a, 0fdafdaef796816a9ed0fd7ac812932d569d9beb, 952e7a7e317f126d0a2b879fc531b716932d5ffa, 56dfffea9fd3be0b3795a9ca6401e133a8427e0b
LinuxLinux Kernel2.6.13 up to, but not including, 5.4.293; 5.5 up to, but not including, 5.10.237; 5.11 up to, but not including, 5.15.181; 5.16 up to, but not including, 6.1.135; 6.2 up to, but not including, 6.6.88; 6.7 up to, but not including, 6.12.25; 6.13 up to, but not including, 6.14.4; 2.6.12; and 1 more ranges5.4.293, 5.10.237, 5.15.181, 6.1.135, 6.6.88, 6.12.25
DebianDebian Linux11.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: isofs: Prevent the use of too small fid syzbot reported a slab-out-of-bounds Read in isofs_fh_to_parent. [1] The handle_bytes value passed in by the reproducing program is equal to 12. In handle_to_path(), only 12 bytes of memory are allocated for the structure file_handle->f_handle member, which causes an out-of-bounds access when accessing the member parent_block of the structure isofs_fid in isofs, because accessing parent_block requires at least 16 bytes of f_handle. Here, fh_len is used to indirectly confirm that the value of handle_bytes is greater than 3 before accessing parent_block. [1] BUG: KASAN: slab-out-of-bounds in isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183 Read of size 4 at addr ffff0000cc030d94 by task syz-executor215/6466 CPU: 1 UID: 0 PID: 6466 Comm: syz-executor215 Not tainted 6.14.0-rc7-syzkaller-ga2392f333575 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x198/0x550 mm/kasan/report.c:521 kasan_report+0xd8/0x138 mm/kasan/report.c:634 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183 exportfs_decode_fh_raw+0x2dc/0x608 fs/exportfs/expfs.c:523 do_handle_to_path+0xa0/0x198 fs/fhandle.c:257 handle_to_path fs/fhandle.c:385 [inline] do_handle_open+0x8cc/0xb8c fs/fhandle.c:403 __do_sys_open_by_handle_at fs/fhandle.c:443 [inline] __se_sys_open_by_handle_at fs/fhandle.c:434 [inline] __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Allocated by task 6466: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:562 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4294 [inline] __kmalloc_noprof+0x32c/0x54c mm/slub.c:4306 kmalloc_noprof include/linux/slab.h:905 [inline] handle_to_path fs/fhandle.c:357 [inline] do_handle_open+0x5a4/0xb8c fs/fhandle.c:403 __do_sys_open_by_handle_at fs/fhandle.c:443 [inline] __se_sys_open_by_handle_at fs/fhandle.c:434 [inline] __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.