{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37886", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.963Z", "datePublished": "2025-05-09T06:45:48.810Z", "dateUpdated": "2026-08-05T11:58:03.678Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:03.678Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: make wait_context part of q_info\n\nMake the wait_context a full part of the q_info struct rather\nthan a stack variable that goes away after pdsc_adminq_post()\nis done so that the context is still available after the wait\nloop has given up.\n\nThere was a case where a slow development firmware caused\nthe adminq request to time out, but then later the FW finally\nfinished the request and sent the interrupt. The handler tried\nto complete_all() the completion context that had been created\non the stack in pdsc_adminq_post() but no longer existed.\nThis caused bad pointer usage, kernel crashes, and much wailing\nand gnashing of teeth." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The AdminQ is a host control-plane queue with no packet-driven path; reaching it requires local access to a device handle — `/dev/fwctl/fwctlN` (`FWCTL_RPC`), a VFIO-assigned pds VF, or a vhost-vdpa node. No remote or adjacent-network actor can post AdminQ commands.\nAC:L - The attacker creates the required condition rather than waiting for it: fwctl RPCs let userspace choose arbitrary long-running firmware operations, and the 16-entry FW backing queue is trivially congested (documented in sibling commit d9e2f070d8af6) so commands exceed the 5s timeout while still completing later. Once the timeout fires there is no window to win — the stack frame is already dead and the attacker can groom it at leisure before the completion lands.\nPR:L - The fwctl `FWCTL_RPC_CONFIGURATION`/`DEBUG_READ_ONLY` scopes require no capability whatsoever (only file access to the char device), and VFIO/vhost-vdpa device nodes are routinely granted to unprivileged VMM and management users. No real root in the init namespace is needed.\nUI:N - The attacker posts the AdminQ command and the corruption occurs asynchronously from the driver's own workqueue when the firmware completes; no victim action is involved at any point.\nS:U - The stale-stack write and completion abuse occur entirely within the host kernel, the same security authority as the vulnerable driver. No hypervisor, IOMMU, or sandbox boundary is crossed by the corruption itself.\nC:H - The dangling `q_info->dest` write places 16 bytes of firmware-supplied data into a reused kernel stack frame whose subsequent occupant the attacker chooses, and the stale-completion list walk yields arbitrary-pointer dereference primitives that can be leveraged for kernel memory disclosure.\nI:H - This is a 16-byte device-controlled write to a freed stack frame plus `complete_all()` on a stale `struct completion` — writing `UINT_MAX` and traversing/waking an swait list built from attacker-groomed stack bytes, which is an arbitrary-write and control-flow-hijack primitive.\nA:H - The fix commit explicitly reports \"bad pointer usage, kernel crashes\"; additionally, acquiring a raw spinlock at a stale stack address can hang the AdminQ workqueue indefinitely, and the condition is repeatable at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/amd/pds_core/adminq.c", "drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h" ], "versions": [ { "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381", "status": "affected", "versionType": "git" }, { "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "66d7702b42ffdf0dce4808626088268a4e905ca6", "status": "affected", "versionType": "git" }, { "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "520f012fe75fb8efc9f16a57ef929a7a2115d892", "status": "affected", "versionType": "git" }, { "version": "01ba61b55b2041a39c54aefb3153c770dd59a0ef", "lessThan": "3f77c3dfffc7063428b100c4945ca2a7a8680380", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/amd/pds_core/adminq.c", "drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.89", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.5", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.89" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.26" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.14.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381" }, { "url": "https://git.kernel.org/stable/c/66d7702b42ffdf0dce4808626088268a4e905ca6" }, { "url": "https://git.kernel.org/stable/c/520f012fe75fb8efc9f16a57ef929a7a2115d892" }, { "url": "https://git.kernel.org/stable/c/3f77c3dfffc7063428b100c4945ca2a7a8680380" } ], "title": "pds_core: make wait_context part of q_info", "x_generator": { "engine": "bippy-1.2.0" } } } }