{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37820", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.947Z", "datePublished": "2025-05-08T06:26:14.602Z", "dateUpdated": "2026-08-05T11:57:44.618Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:44.618Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: handle NULL returned by xdp_convert_buff_to_frame()\n\nThe function xdp_convert_buff_to_frame() may return NULL if it fails\nto correctly convert the XDP buffer into an XDP frame due to memory\nconstraints, internal errors, or invalid data. Failing to check for NULL\nmay lead to a NULL pointer dereference if the result is used later in\nprocessing, potentially causing crashes, data corruption, or undefined\nbehavior.\n\nOn XDP redirect failure, the associated page must be released explicitly\nif it was previously retained via get_page(). Failing to do so may result\nin a memory leak, as the pages reference count is not decremented." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is the xen-netfront NAPI receive path processing frames delivered from the network, and the triggering condition (slot length > 3264 bytes) is determined directly by the size of the frame the remote peer sends. Consistent with kernel CNA scoring of other driver XDP RX-path crashes (CVE-2026-53069, CVE-2026-53229), this is remotely reachable.\nAC:L - The attacker fully controls the packet size that drives `xdp_convert_buff_to_frame()` to fail, and can repeat it at will with no race, no memory-layout dependency, and no reliance on any state outside their control.\nPR:N - No credentials or account on the target are needed — an unauthenticated remote sender reaching the guest's network interface is sufficient, and a malicious Xen backend can trigger it with no guest privileges at all.\nUI:N - The crash occurs entirely within softirq packet processing on frame receipt; no victim action is required.\nS:U - The NULL dereference happens in the guest kernel that also owns the vulnerable driver, so the impacted component and the vulnerable component share the same security authority; no hypervisor, IOMMU, or VM boundary is crossed.\nC:N - The defect is a NULL pointer dereference plus a page reference-count leak — neither yields an out-of-bounds read, freed-object reuse, or any disclosure of kernel memory to the attacker.\nI:N - No attacker-controlled write occurs; the refcount is only incremented (leaked, never underflowed), so there is no memory corruption or control-flow hijack primitive.\nA:H - `xdp_return_frame_rx_napi(NULL)` dereferences NULL inside NAPI/softirq context, producing an oops that is fatal in interrupt context (full kernel panic), and it can be re-triggered with every oversized frame." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/xen-netfront.c" ], "versions": [ { "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "5b83d30c63f9964acb1bc63eb8e670b9e0d2c240", "status": "affected", "versionType": "git" }, { "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa", "status": "affected", "versionType": "git" }, { "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9", "status": "affected", "versionType": "git" }, { "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "eefccd889df3b49d92e7349d94c4aa7e1ba19f6c", "status": "affected", "versionType": "git" }, { "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c", "lessThan": "cc3628dcd851ddd8d418bf0c897024b4621ddc92", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/xen-netfront.c" ], "versions": [ { "version": "5.9", "status": "affected" }, { "version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.136", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.89", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.5", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.1.136" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.6.89" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.12.26" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.14.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5b83d30c63f9964acb1bc63eb8e670b9e0d2c240" }, { "url": "https://git.kernel.org/stable/c/cefd8a2e2de46209ce66e6d30c237eb59b6c5bfa" }, { "url": "https://git.kernel.org/stable/c/d6a9c4e6f9b3ec3ad98468c950ad214af8a2efb9" }, { "url": "https://git.kernel.org/stable/c/eefccd889df3b49d92e7349d94c4aa7e1ba19f6c" }, { "url": "https://git.kernel.org/stable/c/cc3628dcd851ddd8d418bf0c897024b4621ddc92" } ], "title": "xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:55:53.465Z" } } ] } }