Critical Division by Zero Vulnerability in Linux Kernel (CVE-2025-37769)
Summary
CVE-2025-37769: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/smu11: Prevent division by zero The user can set any speed value. Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system and is widely used in various environments, from servers to embedded systems. The kernel is modular, allowing for the addition of features and drivers, but its complexity also makes it susceptible to vulnerabilities. This specific issue affects the AMD GPU driver within the kernel, where improper handling of speed values can lead to critical errors.
Vulnerability Detail
CVE-2025-37769 is a vulnerability found in the Linux kernel related to the AMD GPU driver. It arises when a user sets a speed value that exceeds UINT_MAX/8, leading to a potential division by zero error. This flaw can cause system crashes or unpredictable behavior, impacting the stability and security of the operating system. The vulnerability was identified by the Linux Verification Center and is particularly concerning as it allows users to manipulate speed settings without proper validation.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-37769 represents a significant risk within the Linux kernel, particularly affecting the AMD GPU driver. Users are strongly advised to update their systems to the patched version to prevent potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37769 is a vulnerability in the Linux kernel that can lead to a division by zero error when certain speed values are set by the user.
Exploiting this vulnerability can cause system crashes or unpredictable behavior, potentially compromising system stability and security.
If you are using a version of the Linux kernel prior to the patched version (6.1.135-1 for Debian 12), your system may be at risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
