CVE-2025-37894
A critical bug in the Linux kernel could cause the system to crash when handling certain network packets. The issue occurs when the kernel mistakenly treats a special socket type as a normal one, leading to a crash. The problem has been fixed in the kernel code.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, particularly versions 6.15 and earlier that have not applied the fix.
Real-world impact
An attacker could trigger a kernel crash by sending crafted network traffic, potentially causing a denial of service and allowing the attacker to gain control of the system if they can exploit the crash to execute arbitrary code.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no special privileges, and can completely compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the fix (e.g., 6.15 or later).
- 02Reboot the system to load the updated kernel.
NVD description indicates the vulnerability has been resolved in the kernel.
Timeline
- May 20, 2025 · May 20, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.