Memory Safety Vulnerability in Linux Kernel: CVE-2025-37938
Summary
CVE-2025-37938: In the Linux kernel, the following vulnerability has been resolved: tracing: Verify event formats that have "%*p.." The trace event verifier checks the formats of trace events to make sure that they do not point at memor... Affects linux versions < 6.1.137-1. Fixed in 6.1.137-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, such as CVE-2025-37938, which affects the integrity of trace event formats, potentially leading to system crashes.
Vulnerability Detail
CVE-2025-37938 is a vulnerability in the Linux kernel related to the tracing subsystem. It arises when the trace event verifier fails to properly check formats that include '%*p..'. This oversight can allow an event to reference data that is freed before the event is read, leading to potential kernel crashes due to dereferencing freed memory. This vulnerability poses significant risks, as it can compromise system stability and reliability.
How To Fix
Minimum fixed version
6.1.137-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
CVE-2025-37938 is a critical vulnerability in the Linux kernel that can lead to system crashes due to improper handling of trace event formats. It is essential for users to update their systems to the patched versions to ensure stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37938 is a vulnerability in the Linux kernel that affects the tracing subsystem, potentially leading to system crashes.
If exploited, this vulnerability can cause the kernel to crash by reading freed memory, leading to system instability.
You should update your Linux package to the patched version as soon as possible to mitigate the risk.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
You can find more details about CVE-2025-37938 in the official CVE database or through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.