01 Record

CVE-2025-37949

xenbus: Use kref to track req lifetime

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

xenbus: Use kref to track req lifetime

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.20% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 10.3% of scored records. A rank, not a probability.
NVD base score: 5.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-07-30.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-05-20 16:01Z1 YR AGO

Last updated

2026-08-05 11:58Z1 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-476NULL Pointer DereferenceBase

Data version

5.2

Document digest

b77f593306f7385327da608747a6951c43ee865249bf64ac69981693d2fcd04b

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxfd8aa9095a95c02dcc35540a263267c29b8fda9d to < 0e94a246bb6d9538010b6c02d2b1d4717a97b2e5, fd8aa9095a95c02dcc35540a263267c29b8fda9d to < f1bcac367bc95631afbb918348f30dec887d0e1b, fd8aa9095a95c02dcc35540a263267c29b8fda9d to < 4d260a5558df4650eb87bc41b2c9ac2d6b2ba447, fd8aa9095a95c02dcc35540a263267c29b8fda9d to < 8b02f85e84dc6f7c150cef40ddb69af5a25659e5, fd8aa9095a95c02dcc35540a263267c29b8fda9d to < cbfaf46b88a4c01b64c4186cdccd766c19ae644c, fd8aa9095a95c02dcc35540a263267c29b8fda9d to < 8e9c8a0393b5f85f1820c565ab8105660f4e8f92, fd8aa9095a95c02dcc35540a263267c29b8fda9d to < 2466b0f66795c3c426cacc8998499f38031dbb59, fd8aa9095a95c02dcc35540a263267c29b8fda9d to < 1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27, 4.11—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/0e94a246bb6d9538010b6c02d2b1d4717a97b2e5
git.kernel.orghttps://git.kernel.org/stable/c/f1bcac367bc95631afbb918348f30dec887d0e1b
git.kernel.orghttps://git.kernel.org/stable/c/4d260a5558df4650eb87bc41b2c9ac2d6b2ba447
git.kernel.orghttps://git.kernel.org/stable/c/8b02f85e84dc6f7c150cef40ddb69af5a25659e5
git.kernel.orghttps://git.kernel.org/stable/c/cbfaf46b88a4c01b64c4186cdccd766c19ae644c
git.kernel.orghttps://git.kernel.org/stable/c/8e9c8a0393b5f85f1820c565ab8105660f4e8f92
git.kernel.orghttps://git.kernel.org/stable/c/2466b0f66795c3c426cacc8998499f38031dbb59
git.kernel.orghttps://git.kernel.org/stable/c/1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/08/msg00010.html

01 Record index

CVE-2025-37949

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2025-37949

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References