CVE-2025-37987
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
20/05/2025
Last modified:
14/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
pds_core: Prevent possible adminq overflow/stuck condition<br />
<br />
The pds_core&#39;s adminq is protected by the adminq_lock, which prevents<br />
more than 1 command to be posted onto it at any one time. This makes it<br />
so the client drivers cannot simultaneously post adminq commands.<br />
However, the completions happen in a different context, which means<br />
multiple adminq commands can be posted sequentially and all waiting<br />
on completion.<br />
<br />
On the FW side, the backing adminq request queue is only 16 entries<br />
long and the retry mechanism and/or overflow/stuck prevention is<br />
lacking. This can cause the adminq to get stuck, so commands are no<br />
longer processed and completions are no longer sent by the FW.<br />
<br />
As an initial fix, prevent more than 16 outstanding adminq commands so<br />
there&#39;s no way to cause the adminq from getting stuck. This works<br />
because the backing adminq request queue will never have more than 16<br />
pending adminq commands, so it will never overflow. This is done by<br />
reducing the adminq depth to 16.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.4 (including) | 6.6.93 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.26 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.14.5 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



