Kernel Vulnerability in Linux Packages: LoongArch PMD Handling Issue
Summary
CVE-2025-37818: In the Linux kernel, the following vulnerability has been resolved: LoongArch: Return NULL from huge_pte_offset() for invalid PMD LoongArch's huge_pte_offset() currently returns a pointer to a PMD slot even if the underl... Affects linux versions < 6.1.137-1. Fixed in 6.1.137-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various distributions, including Debian 11, 12, and 13. This vulnerability specifically affects the LoongArch architecture, where the handling of page table entries can lead to system instability.
Vulnerability Detail
In the Linux kernel, the huge_pte_offset() function for the LoongArch architecture incorrectly returns a pointer to a PMD slot even when the entry points to an invalid_pte_table. This misbehavior can cause functions like smaps_hugetlb_range() to fetch invalid entry values, leading to kernel crashes when the system misinterprets these addresses as valid swap entries. The root cause lies in the failure to check the PMD entry's validity before returning a pointer, which can result in severe system crashes.
How To Fix
Minimum fixed version
6.1.137-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-37818 is a significant vulnerability in the Linux kernel affecting the LoongArch architecture, which can lead to system crashes due to improper handling of page table entries. Users are strongly encouraged to update their systems to the latest patched version to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37818 is a vulnerability in the Linux kernel affecting the LoongArch architecture, where the huge_pte_offset() function can return invalid pointers, leading to potential kernel crashes.
If your system uses the LoongArch architecture and is running an affected version of the Linux kernel, it may experience crashes or instability due to misinterpretation of page table entries.
Yes, a patch is being developed and users are advised to update their Linux packages to the latest version that includes the fix for CVE-2025-37818.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds available, it is crucial to monitor your system for any unusual behavior and apply the patch as soon as it is released.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
