High severity8.8NVD Advisory· Published May 29, 2025· Updated Jul 30, 2026
CVE-2025-37996
CVE-2025-37996
Description
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()
Commit fce886a60207 ("KVM: arm64: Plumb the pKVM MMU in KVM") made the initialization of the local memcache variable in user_mem_abort() conditional, leaving a codepath where it is used uninitialized via kvm_pgtable_stage2_map().
This can fail on any path that requires a stage-2 allocation without transition via a permission fault or dirty logging.
Fix this by making sure that memcache is always valid.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
96.14+ 7 more
- (no CPE)range: 6.14
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.14,<6.14.7
- cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.