Bug 2365032 (CVE-2025-37819) - CVE-2025-37819 kernel: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
Summary: CVE-2025-37819 kernel: irqchip/gic-v2m: Prevent use after free of gicv2m_get_...
Keywords:
Status: NEW
Alias: CVE-2025-37819
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-08 07:02 UTC by OSIDB Bzimport
Modified: 2025-05-08 10:26 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-05-08 07:02:26 UTC
In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()

With ACPI in place, gicv2m_get_fwnode() is registered with the pci
subsystem as pci_msi_get_fwnode_cb(), which may get invoked at runtime
during a PCI host bridge probe. But, the call back is wrongly marked as
__init, causing it to be freed, while being registered with the PCI
subsystem and could trigger:

 Unable to handle kernel paging request at virtual address ffff8000816c0400
  gicv2m_get_fwnode+0x0/0x58 (P)
  pci_set_bus_msi_domain+0x74/0x88
  pci_register_host_bridge+0x194/0x548

This is easily reproducible on a Juno board with ACPI boot.

Retain the function for later use.

Comment 1 Avinash Hanwate 2025-05-08 10:16:42 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025050820-CVE-2025-37819-a3b9@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.