{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-37949",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-37949",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-05-20T16:01:45.242Z",
    "updatedAt": "2026-10-15T21:52:04.919Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "xenbus: Use kref to track req lifetime",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nxenbus: Use kref to track req lifetime\n\nMarek reported seeing a NULL pointer fault in the xenbus_thread\ncallstack:\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nRIP: e030:__wake_up_common+0x4c/0x180\nCall Trace:\n <TASK>\n __wake_up_common_lock+0x82/0xd0\n process_msg+0x18e/0x2f0\n xenbus_thread+0x165/0x1c0\n\nprocess_msg+0x18e is req->cb(req).  req->cb is set to xs_wake_up(), a\nthin wrapper around wake_up(), or xenbus_dev_queue_reply().  It seems\nlike it was xs_wake_up() in this case.\n\nIt seems like req may have woken up the xs_wait_for_reply(), which\nkfree()ed the req.  When xenbus_thread resumes, it faults on the zero-ed\ndata.\n\nLinux Device Drivers 2nd edition states:\n\"Normally, a wake_up call can cause an immediate reschedule to happen,\nmeaning that other processes might run before wake_up returns.\"\n... which would match the behaviour observed.\n\nChange to keeping two krefs on each request.  One for the caller, and\none for xenbus_thread.  Each will kref_put() when finished, and the last\nwill free it.\n\nThis use of kref matches the description in\nDocumentation/core-api/kref.rst",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "0e94a246bb6d9538010b6c02d2b1d4717a97b2e5"
            },
            {
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f1bcac367bc95631afbb918348f30dec887d0e1b"
            },
            {
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4d260a5558df4650eb87bc41b2c9ac2d6b2ba447"
            },
            {
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "8b02f85e84dc6f7c150cef40ddb69af5a25659e5"
            },
            {
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "cbfaf46b88a4c01b64c4186cdccd766c19ae644c"
            },
            {
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "8e9c8a0393b5f85f1820c565ab8105660f4e8f92"
            },
            {
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2466b0f66795c3c426cacc8998499f38031dbb59"
            },
            {
              "version": "fd8aa9095a95c02dcc35540a263267c29b8fda9d",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "4.11",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "4.11"
            },
            {
              "version": "5.4.294",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "version": "5.10.238",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.183",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.139",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.91",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.29",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.14.7",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.14.*"
            },
            {
              "version": "6.15",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}