Riskcovery

CVE-2025-37916

pds_core: remove write-after-free of client_id

State
Published
Severity
Not scored
Published
May 20, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

pds_core: remove write-after-free of client_id

A use-after-free error popped up in stress testing:

[Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47): [Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0x70 [Mon Apr 21 21:21:33 2025] device_release_driver_internal+0x11f/0x180 [Mon Apr 21 21:21:33 2025] driver_detach+0x45/0x80 [Mon Apr 21 21:21:33 2025] bus_remove_driver+0x83/0xe0 [Mon Apr 21 21:21:33 2025] pci_unregister_driver+0x1a/0x80

The actual device uninit usually happens on a separate thread scheduled after this code runs, but there is no guarantee of order of thread execution, so this could be a problem. There's no actual need to clear the client_id at this point, so simply remove the offending code.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 10659034c622738bc1bfab8a76fc576c52d5acce to before 9b467c5bcdb45a41d2a49fbb9ffca73d1380e99bAffected
  • 10659034c622738bc1bfab8a76fc576c52d5acce to before c649b9653ed09196e91d3f4b16b679041b3c42e6Affected
  • 10659034c622738bc1bfab8a76fc576c52d5acce to before 26dc701021302f11c8350108321d11763bd81dfeAffected
  • 10659034c622738bc1bfab8a76fc576c52d5acce to before dfd76010f8e821b66116dec3c7d90dd2403d1396Affected
LinuxLinux
  • 6.4Affected
  • before 6.4Not affected
  • 6.6.90 through 6.6.*Not affected
  • 6.12.28 through 6.12.*Not affected
  • 6.14.6 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.