CVE-2025-37773

virtiofs: add filesystem context source name check

MEDIUM

5.5

CVSS Score

Published: May 1, 2025 at 01:07 PM UTC

Updated: June 17, 2026 at 09:15 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem context source name check In certain scenarios, for example, during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an extra check for the source name should be added.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

5.11 ≤ v < 5.15.1815.16 ≤ v < 6.1.1355.4 ≤ v < 5.10.2375.4 ≤ v < 5.15.1815.4 ≤ v < 5.4.2935.4 ≤ v < 6.1.1355.4 ≤ v < 6.12.255.4 ≤ v < 6.14.45.4 ≤ v < 6.155.4 ≤ v < 6.6.885.5 ≤ v < 5.10.2376.13 ≤ v < 6.14.46.2 ≤ v < 6.6.886.7 ≤ v < 6.12.255.4 6.15 rc1 6.15 rc2a62a8ef9d97da23762a588592c8b8eb50a8deb6a

Vendor states this is fixed in 599d1e2a6aecc44acf22fe7ea6f5e84a7e526abe (fixed)

Vendor states this is fixed in 5ee09cdaf3414f6c92960714af46d3d90eede2f3 (fixed)

Vendor states this is fixed in 9d6dcf18a1b49990295ac8a05fd9bdfd27ccbf88 (fixed)

Vendor states this is fixed in a648d80f8d9b208beee03a2d9aa690cfacf1d41e (fixed)

Vendor states this is fixed in a94fd938df2b1628da66b498aa0eeb89593bc7a2 (fixed)

Vendor states this is fixed in b84f13fdad10a543e2e65bab7e81b3f0bceabd67 (fixed)

Vendor states this is fixed in c3e31d613951c299487844c4d1686a933e8ee291 (fixed)

Vendor states this is fixed in f6ec52710dc5e156b774cbef5d0f5c99b1c53a80 (fixed)

Vendor states this is fixed in 5.10.237 (unaffected)

Vendor states this is fixed in 5.15.181 (unaffected)

Vendor states this is fixed in 5.4 (unaffected)

Vendor states this is fixed in 5.4.293 (unaffected)