CVE-2025-37886

pds_core: make wait_context part of q_info

MEDIUM
5.5
CVSS Score
Published: May 9, 2025 at 06:45 AM UTC
Updated: August 5, 2026 at 12:44 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: pds_core: make wait_context part of q_info Make the wait_context a full part of the q_info struct rather than a stack variable that goes away after pdsc_adminq_post() is done so that the context is still available after the wait loop has given up. There was a case where a slow development firmware caused the adminq request to time out, but then later the FW finally finished the request and sent the interrupt. The handler tried to complete_all() the completion context that had been created on the stack in pdsc_adminq_post() but no longer existed. This caused bad pointer usage, kernel crashes, and much wailing and gnashing of teeth.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.13 ≤ v < 6.14.56.4 ≤ v < 6.12.266.4 ≤ v < 6.14.56.4 ≤ v < 6.156.4 ≤ v < 6.6.896.7 ≤ v < 6.12.261ba61b55b2041a39c54aefb3153c770dd59a0ef6.15 rc16.15 rc26.15 rc3
Vendor states this is fixed in 1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381 (fixed)
Vendor states this is fixed in 3f77c3dfffc7063428b100c4945ca2a7a8680380 (fixed)
Vendor states this is fixed in 520f012fe75fb8efc9f16a57ef929a7a2115d892 (fixed)
Vendor states this is fixed in 66d7702b42ffdf0dce4808626088268a4e905ca6 (fixed)
Vendor states this is fixed in 6.12.26 (unaffected)
Vendor states this is fixed in 6.14.5 (unaffected)
Vendor states this is fixed in 6.15 (unaffected)
Vendor states this is fixed in 6.4 (unaffected)
Vendor states this is fixed in 6.6.89 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3f77c3dfffc7063428b100c4945ca2a7a8680380
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/520f012fe75fb8efc9f16a57ef929a7a2115d892
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/66d7702b42ffdf0dce4808626088268a4e905ca6

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card