CVE-2025-37846
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
arm64: mops: Do not dereference src reg for a set operation
In the Linux kernel, the following vulnerability has been resolved: arm64: mops: Do not dereference src reg for a set operation The source register is not used for SET* and reading it can result in a UBSAN out-of-bounds array access error, specifically when the MOPS exception is taken from a SET* sequence with XZR (reg 31) as the source. Architecturally this is the only case where a src/dst/size field in the ESR can be reported as 31. Prior to 2de451a329cf662b the code in do_el0_mops() was benign as the use of pt_regs_read_reg() prevented the out-of-bounds access.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2de451a329cf662beeba71f63c7f83ee24ca6642 | affected | git | eec737e17e5567e08148550a7f1d94d495b9fb17 | Unavailable | None listed |
| 2de451a329cf662beeba71f63c7f83ee24ca6642 | affected | git | 43267d934eacff6c70e15545d804ebbcab8a0bf5 | Unavailable | None listed |
| 2de451a329cf662beeba71f63c7f83ee24ca6642 | affected | git | 5f6022a74147675124b781fdc056b291850e7786 | Unavailable | None listed |
| 2de451a329cf662beeba71f63c7f83ee24ca6642 | affected | git | a13bfa4fe0d6949cea14718df2d1fe84c38cd113 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.7 | Unavailable | None listed |
| 6.12.24 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.13.12 | unaffected | semver | Unavailable | 6.13.* | None listed |
| 6.14.3 | unaffected | semver | Unavailable | 6.14.* | None listed |
| 6.15 | unaffected | original_commit_for_fix | Unavailable | * | None listed |