CVE-2025-37898

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
20/05/2025
Last modified:
19/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powerpc64/ftrace: fix module loading without patchable function entries<br /> <br /> get_stubs_size assumes that there must always be at least one patchable<br /> function entry, which is not always the case (modules that export data<br /> but no code), otherwise it returns -ENOEXEC and thus the section header<br /> sh_size is set to that value. During module_memory_alloc() the size is<br /> passed to execmem_alloc() after being page-aligned and thus set to zero<br /> which will cause it to fail the allocation (and thus module loading) as<br /> __vmalloc_node_range() checks for zero-sized allocs and returns null:<br /> <br /> [ 115.466896] module_64: cast_common: doesn&amp;#39;t contain __patchable_function_entries.<br /> [ 115.469189] ------------[ cut here ]------------<br /> [ 115.469496] WARNING: CPU: 0 PID: 274 at mm/vmalloc.c:3778 __vmalloc_node_range_noprof+0x8b4/0x8f0<br /> ...<br /> [ 115.478574] ---[ end trace 0000000000000000 ]---<br /> [ 115.479545] execmem: unable to allocate memory<br /> <br /> Fix this by removing the check completely, since it is anyway not<br /> helpful to propagate this as an error upwards.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.14.6 (excluding)
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*