Bug 2365032 (CVE-2025-37819) - CVE-2025-37819 kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability
Summary: CVE-2025-37819 kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerabi...
Keywords:
Status: NEW
Alias: CVE-2025-37819
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-08 07:02 UTC by OSIDB Bzimport
Modified: 2026-02-02 09:50 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:1194 0 None None None 2026-01-26 14:09:50 UTC
Red Hat Product Errata RHSA-2026:1236 0 None None None 2026-01-26 16:23:33 UTC
Red Hat Product Errata RHSA-2026:1444 0 None None None 2026-01-28 00:36:38 UTC
Red Hat Product Errata RHSA-2026:1690 0 None None None 2026-02-02 09:50:30 UTC

Description OSIDB Bzimport 2025-05-08 07:02:26 UTC
In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()

With ACPI in place, gicv2m_get_fwnode() is registered with the pci
subsystem as pci_msi_get_fwnode_cb(), which may get invoked at runtime
during a PCI host bridge probe. But, the call back is wrongly marked as
__init, causing it to be freed, while being registered with the PCI
subsystem and could trigger:

 Unable to handle kernel paging request at virtual address ffff8000816c0400
  gicv2m_get_fwnode+0x0/0x58 (P)
  pci_set_bus_msi_domain+0x74/0x88
  pci_register_host_bridge+0x194/0x548

This is easily reproducible on a Juno board with ACPI boot.

Retain the function for later use.

Comment 1 Avinash Hanwate 2025-05-08 10:16:42 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025050820-CVE-2025-37819-a3b9@gregkh/T

Comment 2 errata-xmlrpc 2026-01-26 14:09:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:1194 https://access.redhat.com/errata/RHSA-2026:1194

Comment 3 errata-xmlrpc 2026-01-26 16:23:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:1236 https://access.redhat.com/errata/RHSA-2026:1236

Comment 4 errata-xmlrpc 2026-01-28 00:36:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:1444 https://access.redhat.com/errata/RHSA-2026:1444

Comment 5 errata-xmlrpc 2026-02-02 09:50:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:1690 https://access.redhat.com/errata/RHSA-2026:1690


Note You need to log in before you can comment on or make changes to this bug.