GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37846 (GCVE-0-2025-37846)

Vulnerability from cvelistv5 – Published: 2025-05-09 06:41 – Updated: 2026-05-11 21:16
VLAI
Title
arm64: mops: Do not dereference src reg for a set operation
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64: mops: Do not dereference src reg for a set operation The source register is not used for SET* and reading it can result in a UBSAN out-of-bounds array access error, specifically when the MOPS exception is taken from a SET* sequence with XZR (reg 31) as the source. Architecturally this is the only case where a src/dst/size field in the ESR can be reported as 31. Prior to 2de451a329cf662b the code in do_el0_mops() was benign as the use of pt_regs_read_reg() prevented the out-of-bounds access.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2de451a329cf662beeba71f63c7f83ee24ca6642 , < eec737e17e5567e08148550a7f1d94d495b9fb17 (git)
Affected: 2de451a329cf662beeba71f63c7f83ee24ca6642 , < 43267d934eacff6c70e15545d804ebbcab8a0bf5 (git)
Affected: 2de451a329cf662beeba71f63c7f83ee24ca6642 , < 5f6022a74147675124b781fdc056b291850e7786 (git)
Affected: 2de451a329cf662beeba71f63c7f83ee24ca6642 , < a13bfa4fe0d6949cea14718df2d1fe84c38cd113 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.24 , ≤ 6.12.* (semver)
Unaffected: 6.13.12 , ≤ 6.13.* (semver)
Unaffected: 6.14.3 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/traps.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eec737e17e5567e08148550a7f1d94d495b9fb17",
              "status": "affected",
              "version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
              "versionType": "git"
            },
            {
              "lessThan": "43267d934eacff6c70e15545d804ebbcab8a0bf5",
              "status": "affected",
              "version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
              "versionType": "git"
            },
            {
              "lessThan": "5f6022a74147675124b781fdc056b291850e7786",
              "status": "affected",
              "version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
              "versionType": "git"
            },
            {
              "lessThan": "a13bfa4fe0d6949cea14718df2d1fe84c38cd113",
              "status": "affected",
              "version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/traps.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.24",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.12",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mops: Do not dereference src reg for a set operation\n\nThe source register is not used for SET* and reading it can result in\na UBSAN out-of-bounds array access error, specifically when the MOPS\nexception is taken from a SET* sequence with XZR (reg 31) as the\nsource. Architecturally this is the only case where a src/dst/size\nfield in the ESR can be reported as 31.\n\nPrior to 2de451a329cf662b the code in do_el0_mops() was benign as the\nuse of pt_regs_read_reg() prevented the out-of-bounds access."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:16:14.509Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eec737e17e5567e08148550a7f1d94d495b9fb17"
        },
        {
          "url": "https://git.kernel.org/stable/c/43267d934eacff6c70e15545d804ebbcab8a0bf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f6022a74147675124b781fdc056b291850e7786"
        },
        {
          "url": "https://git.kernel.org/stable/c/a13bfa4fe0d6949cea14718df2d1fe84c38cd113"
        }
      ],
      "title": "arm64: mops: Do not dereference src reg for a set operation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37846",
    "datePublished": "2025-05-09T06:41:54.648Z",
    "dateReserved": "2025-04-16T04:51:23.953Z",
    "dateUpdated": "2026-05-11T21:16:14.509Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37846",
      "date": "2026-09-16",
      "epss": "0.00274",
      "percentile": "0.19849"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37846\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-09T07:16:05.430\",\"lastModified\":\"2026-06-17T09:15:33.403\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: mops: Do not dereference src reg for a set operation\\n\\nThe source register is not used for SET* and reading it can result in\\na UBSAN out-of-bounds array access error, specifically when the MOPS\\nexception is taken from a SET* sequence with XZR (reg 31) as the\\nsource. Architecturally this is the only case where a src/dst/size\\nfield in the ESR can be reported as 31.\\n\\nPrior to 2de451a329cf662b the code in do_el0_mops() was benign as the\\nuse of pt_regs_read_reg() prevented the out-of-bounds access.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: mops: No desreferenciar el registro src para una operaci\u00f3n set. El registro fuente no se utiliza para SET* y leerlo puede resultar en un error de acceso a la matriz UBSAN fuera de los l\u00edmites, espec\u00edficamente cuando la excepci\u00f3n MOPS se toma de una secuencia SET* con XZR (reg 31) como origen. Arquitect\u00f3nicamente, este es el \u00fanico caso donde un campo src/dst/size en el ESR puede reportarse como 31. Antes de 2de451a329cf662b, el c\u00f3digo en do_el0_mops() era benigno ya que el uso de pt_regs_read_reg() imped\u00eda el acceso fuera de los l\u00edmites.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/include/asm/traps.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2de451a329cf662beeba71f63c7f83ee24ca6642\",\"lessThan\":\"eec737e17e5567e08148550a7f1d94d495b9fb17\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2de451a329cf662beeba71f63c7f83ee24ca6642\",\"lessThan\":\"43267d934eacff6c70e15545d804ebbcab8a0bf5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2de451a329cf662beeba71f63c7f83ee24ca6642\",\"lessThan\":\"5f6022a74147675124b781fdc056b291850e7786\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2de451a329cf662beeba71f63c7f83ee24ca6642\",\"lessThan\":\"a13bfa4fe0d6949cea14718df2d1fe84c38cd113\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/include/asm/traps.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.24\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.12\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.3\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.24\",\"matchCriteriaId\":\"1D35A8A8-F3EC-45E6-AD37-1F154B27529D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.12\",\"matchCriteriaId\":\"4A475784-BF3B-4514-81EE-49C8522FB24A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.3\",\"matchCriteriaId\":\"483E2E15-2135-4EC6-AB64-16282C5EF704\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/43267d934eacff6c70e15545d804ebbcab8a0bf5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5f6022a74147675124b781fdc056b291850e7786\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a13bfa4fe0d6949cea14718df2d1fe84c38cd113\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eec737e17e5567e08148550a7f1d94d495b9fb17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T00:08:07+00:00",
      "cve": "CVE-2025-37846",
      "id": "CVE-2025-37846",
      "initial_release_date": "2025-05-09T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: arm64: mops: Do not dereference src reg for a set operation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37846.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:21:14Z",
      "cve": "CVE-2025-37846",
      "id": "CVE-2025-37846",
      "initial_release_date": "2025-05-10T02:53:05Z",
      "product_status:known_affected": "461",
      "product_status:known_not_affected": "404",
      "product_status:recommended": "153",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37846",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37846.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.