CVE-2025-37939

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37939
In the Linux kernel, the following vulnerability has been resolved: libbpf: Fix accessing BTF.ext core_relo header Update btf_ext_parse_info() to ensure the core_relo header is present before reading its fields. This avoids a potential buffer read overflow reported by the OSS Fuzz project.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0a7c2a84359612e54328aa52030eb202093da6e2 Patch
https://git.kernel.org/stable/c/3a67f60f0a8be10cea7a884a1a00e9feb6645657 Patch
https://git.kernel.org/stable/c/d529411ec44535308c5d59cbeff74be6fe14b479 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Nov 2025, 14:57

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0a7c2a84359612e54328aa52030eb202093da6e2 - () https://git.kernel.org/stable/c/0a7c2a84359612e54328aa52030eb202093da6e2 - Patch
References () https://git.kernel.org/stable/c/3a67f60f0a8be10cea7a884a1a00e9feb6645657 - () https://git.kernel.org/stable/c/3a67f60f0a8be10cea7a884a1a00e9feb6645657 - Patch
References () https://git.kernel.org/stable/c/d529411ec44535308c5d59cbeff74be6fe14b479 - () https://git.kernel.org/stable/c/d529411ec44535308c5d59cbeff74be6fe14b479 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: libbpf: Se corrige el acceso al encabezado core_relo de BTF.ext. Se actualiza btf_ext_parse_info() para garantizar que el encabezado core_relo esté presente antes de leer sus campos. Esto evita un posible desbordamiento de lectura del búfer reportado por el proyecto OSS Fuzz.
First Time Linux
Linux linux Kernel
CWE CWE-120

20 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-20 16:15

Updated : 2025-11-17 14:57

NVD link : CVE-2025-37939

Mitre link : CVE-2025-37939

CVE.ORG link : CVE-2025-37939

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')