{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37876", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.960Z", "datePublished": "2025-05-09T06:45:40.934Z", "dateUpdated": "2026-08-05T11:57:59.281Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:59.281Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Only create /proc/fs/netfs with CONFIG_PROC_FS\n\nWhen testing a special config:\n\nCONFIG_NETFS_SUPPORTS=y\nCONFIG_PROC_FS=n\n\nThe system crashes with something like:\n\n[ 3.766197] ------------[ cut here ]------------\n[ 3.766484] kernel BUG at mm/mempool.c:560!\n[ 3.766789] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[ 3.767123] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W\n[ 3.767777] Tainted: [W]=WARN\n[ 3.767968] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n[ 3.768523] RIP: 0010:mempool_alloc_slab.cold+0x17/0x19\n[ 3.768847] Code: 50 fe ff 58 5b 5d 41 5c 41 5d 41 5e 41 5f e9 93 95 13 00\n[ 3.769977] RSP: 0018:ffffc90000013998 EFLAGS: 00010286\n[ 3.770315] RAX: 000000000000002f RBX: ffff888100ba8640 RCX: 0000000000000000\n[ 3.770749] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 00000000ffffffff\n[ 3.771217] RBP: 0000000000092880 R08: 0000000000000000 R09: ffffc90000013828\n[ 3.771664] R10: 0000000000000001 R11: 00000000ffffffea R12: 0000000000092cc0\n[ 3.772117] R13: 0000000000000400 R14: ffff8881004b1620 R15: ffffea0004ef7e40\n[ 3.772554] FS: 0000000000000000(0000) GS:ffff8881b5f3c000(0000) knlGS:0000000000000000\n[ 3.773061] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 3.773443] CR2: ffffffff830901b4 CR3: 0000000004296001 CR4: 0000000000770ef0\n[ 3.773884] PKRU: 55555554\n[ 3.774058] Call Trace:\n[ 3.774232] \n[ 3.774371] mempool_alloc_noprof+0x6a/0x190\n[ 3.774649] ? _printk+0x57/0x80\n[ 3.774862] netfs_alloc_request+0x85/0x2ce\n[ 3.775147] netfs_readahead+0x28/0x170\n[ 3.775395] read_pages+0x6c/0x350\n[ 3.775623] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 3.775928] page_cache_ra_unbounded+0x1bd/0x2a0\n[ 3.776247] filemap_get_pages+0x139/0x970\n[ 3.776510] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 3.776820] filemap_read+0xf9/0x580\n[ 3.777054] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 3.777368] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 3.777674] ? find_held_lock+0x32/0x90\n[ 3.777929] ? netfs_start_io_read+0x19/0x70\n[ 3.778221] ? netfs_start_io_read+0x19/0x70\n[ 3.778489] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 3.778800] ? lock_acquired+0x1e6/0x450\n[ 3.779054] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 3.779379] netfs_buffered_read_iter+0x57/0x80\n[ 3.779670] __kernel_read+0x158/0x2c0\n[ 3.779927] bprm_execve+0x300/0x7a0\n[ 3.780185] kernel_execve+0x10c/0x140\n[ 3.780423] ? __pfx_kernel_init+0x10/0x10\n[ 3.780690] kernel_init+0xd5/0x150\n[ 3.780910] ret_from_fork+0x2d/0x50\n[ 3.781156] ? __pfx_kernel_init+0x10/0x10\n[ 3.781414] ret_from_fork_asm+0x1a/0x30\n[ 3.781677] \n[ 3.781823] Modules linked in:\n[ 3.782065] ---[ end trace 0000000000000000 ]---\n\nThis is caused by the following error path in netfs_init():\n\n if (!proc_mkdir(\"fs/netfs\", NULL))\n goto error_proc;\n\nFix this by adding ifdef in netfs_main(), so that /proc/fs/netfs is only\ncreated with CONFIG_PROC_FS." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached via ordinary file I/O (read/mmap/execve) on a locally mounted netfs-backed filesystem (9p, NFS, ceph, cifs, afs, erofs-ondemand), through `netfs_readahead`/`netfs_buffered_read_iter` → `netfs_alloc_request`. No remote peer input drives the faulting allocation, so local access is required.\nAC:H - Triggering requires the kernel to be built with `CONFIG_PROC_FS=n` (plus `CONFIG_NETFS_SUPPORT=y`), a non-default, EXPERT-only configuration that is rare in practice and entirely beyond the attacker's control; with CONFIG_PROC_FS=y the `proc_mkdir(\"fs/netfs\")` failure path is not taken.\nPR:L - An unprivileged local user with read access to any file on a netfs-backed mount triggers `netfs_alloc_request()`; no capability, CAP_SYS_ADMIN, or namespace privilege is checked anywhere along the read path.\nUI:N - On a system with an already-mounted or automounted netfs filesystem (including NFS/9p root), the attacker simply reads a file; no action by another user or administrator is needed.\nS:U - The dangling mempool/slab pointers and the resulting corruption are confined to the kernel's own memory and security authority, with no crossing into a hypervisor, IOMMU, or other security scope.\nC:H - `netfs_alloc_request()` dereferences the destroyed `kmem_cache` via `mempool->pool_data` and `kmem_cache_size(cache)`, a use-after-free read of a freed slab descriptor whose contents an attacker can influence through heap grooming, and the resulting mis-sized allocation/memset can expose adjacent kernel heap data.\nI:H - `kmem_cache_alloc()` is performed on a freed cache descriptor and the object is then zeroed for `kmem_cache_size(cache)` bytes read from that freed memory, giving a controllable-length zero-write past the allocation — a heap corruption primitive usable for control-flow hijacking.\nA:H - The documented and immediate result is a kernel BUG/oops in `mempool_alloc_slab` (`kernel BUG at mm/mempool.c`), which in the reported case killed PID 1 during `bprm_execve` and panics the system; every subsequent netfs request repeats the fault." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/netfs/main.c" ], "versions": [ { "version": "7eb5b3e3a0a55f2d166ca949ef47ca6e0c704aab", "lessThan": "2ef6eea2efce01d1956ace483216f6b6e26330c9", "status": "affected", "versionType": "git" }, { "version": "7eb5b3e3a0a55f2d166ca949ef47ca6e0c704aab", "lessThan": "6c4c5e0b96a90f2a11c378e66edc1f25165e10b6", "status": "affected", "versionType": "git" }, { "version": "7eb5b3e3a0a55f2d166ca949ef47ca6e0c704aab", "lessThan": "40cb48eba3b4b79e110c1a35d33a48cac54507a2", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/netfs/main.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.5", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.26" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.14.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2ef6eea2efce01d1956ace483216f6b6e26330c9" }, { "url": "https://git.kernel.org/stable/c/6c4c5e0b96a90f2a11c378e66edc1f25165e10b6" }, { "url": "https://git.kernel.org/stable/c/40cb48eba3b4b79e110c1a35d33a48cac54507a2" } ], "title": "netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS", "x_generator": { "engine": "bippy-1.2.0" } } } }