CVE-2025-37898
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
20/05/2025
Last modified:
19/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
powerpc64/ftrace: fix module loading without patchable function entries<br />
<br />
get_stubs_size assumes that there must always be at least one patchable<br />
function entry, which is not always the case (modules that export data<br />
but no code), otherwise it returns -ENOEXEC and thus the section header<br />
sh_size is set to that value. During module_memory_alloc() the size is<br />
passed to execmem_alloc() after being page-aligned and thus set to zero<br />
which will cause it to fail the allocation (and thus module loading) as<br />
__vmalloc_node_range() checks for zero-sized allocs and returns null:<br />
<br />
[ 115.466896] module_64: cast_common: doesn&#39;t contain __patchable_function_entries.<br />
[ 115.469189] ------------[ cut here ]------------<br />
[ 115.469496] WARNING: CPU: 0 PID: 274 at mm/vmalloc.c:3778 __vmalloc_node_range_noprof+0x8b4/0x8f0<br />
...<br />
[ 115.478574] ---[ end trace 0000000000000000 ]---<br />
[ 115.479545] execmem: unable to allocate memory<br />
<br />
Fix this by removing the check completely, since it is anyway not<br />
helpful to propagate this as an error upwards.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.14.6 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



