Memory Boundary Vulnerability in Linux Kernel - CVE-2025-37902
Summary
CVE-2025-37902: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and support for a wide range of hardware architectures. This vulnerability arises from improper handling of memory boundaries during argument copying, which can lead to critical system errors.
Vulnerability Detail
CVE-2025-37902 is a vulnerability in the Linux kernel where the size of the reallocated argv is incorrectly copied instead of the size of the old_argv. This flaw allows reading and copying beyond the allocated memory for old_argv, potentially leading to kernel panics and system instability. The issue was identified in the dm_split_args function, which is part of the device mapper functionality in the kernel. The vulnerability can cause severe disruptions in system operations, making it critical to address.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-37902 represents a significant vulnerability in the Linux kernel that can lead to system crashes due to improper memory handling. It is crucial for users to update their systems to the latest patched versions to mitigate risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37902 is a vulnerability in the Linux kernel that involves improper memory handling, leading to potential kernel panics.
This vulnerability can cause system instability and crashes, impacting the reliability of applications running on the affected Linux kernel.
If you are using Debian 12 or 13, your version of the Linux kernel may be affected. It is recommended to check for updates and apply them.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
