Riskcovery

CVE-2025-37996

KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()

State
Published
Severity
8.8 High
Published
May 29, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()

Commit fce886a60207 ("KVM: arm64: Plumb the pKVM MMU in KVM") made the initialization of the local memcache variable in user_mem_abort() conditional, leaving a codepath where it is used uninitialized via kvm_pgtable_stage2_map().

This can fail on any path that requires a stage-2 allocation without transition via a permission fault or dirty logging.

Fix this by making sure that memcache is always valid.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • fce886a6020734d6253c2c5a3bc285e385cc5496 to before a26d50f8a4a5049e956984797b5d0dedea4bbb18Affected
  • fce886a6020734d6253c2c5a3bc285e385cc5496 to before 157dbc4a321f5bb6f8b6c724d12ba720a90f1a7cAffected
LinuxLinux
  • 6.14Affected
  • before 6.14Not affected
  • 6.14.7 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.