CVE-2025-37846
Severity CVSS v4.0:
Pending analysis
Type:
CWE-125
Out-of-bounds Read
Publication date:
09/05/2025
Last modified:
17/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
arm64: mops: Do not dereference src reg for a set operation<br />
<br />
The source register is not used for SET* and reading it can result in<br />
a UBSAN out-of-bounds array access error, specifically when the MOPS<br />
exception is taken from a SET* sequence with XZR (reg 31) as the<br />
source. Architecturally this is the only case where a src/dst/size<br />
field in the ESR can be reported as 31.<br />
<br />
Prior to 2de451a329cf662b the code in do_el0_mops() was benign as the<br />
use of pt_regs_read_reg() prevented the out-of-bounds access.
Impact
Base Score 3.x
7.10
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.24 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.13.12 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.14 (including) | 6.14.3 (excluding) |
To consult the complete list of CPE names with products and versions, see this page