GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37755 (GCVE-0-2025-37755)

Vulnerability from cvelistv5 – Published: 2025-05-01 12:55 – Updated: 2026-08-05 11:57
VLAI
Title
net: libwx: handle page_pool_dev_alloc_pages error
Summary
In the Linux kernel, the following vulnerability has been resolved: net: libwx: handle page_pool_dev_alloc_pages error page_pool_dev_alloc_pages could return NULL. There was a WARN_ON(!page) but it would still proceed to use the NULL pointer and then crash. This is similar to commit 001ba0902046 ("net: fec: handle page_pool_dev_alloc_pages error"). This is found by our static analysis tool KNighter.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3c47e8ae113a68da47987750d9896e325d0aeedd , < c17ef974bfcf1a50818168b47c4606b425a957c4 (git)
Affected: 3c47e8ae113a68da47987750d9896e325d0aeedd , < ad81d666e114ebf989fc9994d4c93d451dc60056 (git)
Affected: 3c47e8ae113a68da47987750d9896e325d0aeedd , < 1dd13c60348f515acd8c6f25a561b9c4e3b04fea (git)
Affected: 3c47e8ae113a68da47987750d9896e325d0aeedd , < 90bec7cef8805f9a23145e070dff28a02bb584eb (git)
Affected: 3c47e8ae113a68da47987750d9896e325d0aeedd , < 7f1ff1b38a7c8b872382b796023419d87d78c47e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.88 , ≤ 6.6.* (semver)
Unaffected: 6.12.24 , ≤ 6.12.* (semver)
Unaffected: 6.13.12 , ≤ 6.13.* (semver)
Unaffected: 6.14.3 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/wangxun/libwx/wx_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c17ef974bfcf1a50818168b47c4606b425a957c4",
              "status": "affected",
              "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
              "versionType": "git"
            },
            {
              "lessThan": "ad81d666e114ebf989fc9994d4c93d451dc60056",
              "status": "affected",
              "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
              "versionType": "git"
            },
            {
              "lessThan": "1dd13c60348f515acd8c6f25a561b9c4e3b04fea",
              "status": "affected",
              "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
              "versionType": "git"
            },
            {
              "lessThan": "90bec7cef8805f9a23145e070dff28a02bb584eb",
              "status": "affected",
              "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
              "versionType": "git"
            },
            {
              "lessThan": "7f1ff1b38a7c8b872382b796023419d87d78c47e",
              "status": "affected",
              "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/wangxun/libwx/wx_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.88",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.24",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: handle page_pool_dev_alloc_pages error\n\npage_pool_dev_alloc_pages could return NULL. There was a WARN_ON(!page)\nbut it would still proceed to use the NULL pointer and then crash.\n\nThis is similar to commit 001ba0902046\n(\"net: fec: handle page_pool_dev_alloc_pages error\").\n\nThis is found by our static analysis tool KNighter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable RX-buffer refill runs in the NIC\u0027s NAPI poll path (`wx_poll` \u2192 `wx_clean_rx_irq` \u2192 `wx_alloc_rx_buffers`), driven entirely by packets received from the wire on internet-facing ngbe/txgbe interfaces. A remote attacker reaches the code by sending traffic, with no local access required.\nAC:L - The trigger is a page-pool allocation failure, which a remote attacker can reliably induce by flooding the interface to force continuous ring refill and drive memory demand; the analogous fec bug was reproduced this way via ordinary network activity under memory pressure. No unpredictable memory layout or victim-state precondition is involved.\nPR:N - The receive path processes packets before any authentication or authorization; the attacker needs no account, credentials, or capabilities on the target. Any host able to send frames to the NIC can drive the path.\nUI:N - Buffer refill happens automatically in softirq context whenever packets are received. No administrator or user action is needed on the victim system.\nS:U - The NULL dereference occurs in kernel context and its impact is confined to the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The fault is a read from a fixed NULL-page offset that immediately oopses; no attacker-controlled memory is read and no kernel data is returned to the attacker. There is no information-disclosure primitive.\nI:N - The bug is a NULL pointer dereference, not an out-of-bounds or use-after-free write; execution aborts at the faulting read before any bogus descriptor address can be programmed. No memory modification or control-flow hijack primitive is available.\nA:H - The dereference oopses in softirq/NAPI context, panicking the machine under panic_on_oops and otherwise killing the RX path and leaving the network stack unusable. This is a complete availability loss triggerable remotely without credentials."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:18.092Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c17ef974bfcf1a50818168b47c4606b425a957c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad81d666e114ebf989fc9994d4c93d451dc60056"
        },
        {
          "url": "https://git.kernel.org/stable/c/1dd13c60348f515acd8c6f25a561b9c4e3b04fea"
        },
        {
          "url": "https://git.kernel.org/stable/c/90bec7cef8805f9a23145e070dff28a02bb584eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f1ff1b38a7c8b872382b796023419d87d78c47e"
        }
      ],
      "title": "net: libwx: handle page_pool_dev_alloc_pages error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37755",
    "datePublished": "2025-05-01T12:55:59.499Z",
    "dateReserved": "2025-04-16T04:51:23.938Z",
    "dateUpdated": "2026-08-05T11:57:18.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37755",
      "date": "2026-09-17",
      "epss": "0.00354",
      "percentile": "0.28941"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:29:56.000Z",
      "cve": "CVE-2025-37755",
      "id": "msrc_CVE-2025-37755",
      "initial_release_date": "2025-05-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: libwx: handle page_pool_dev_alloc_pages error",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-37755.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/wangxun/libwx/wx_lib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c17ef974bfcf1a50818168b47c4606b425a957c4",
                    "status": "affected",
                    "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ad81d666e114ebf989fc9994d4c93d451dc60056",
                    "status": "affected",
                    "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1dd13c60348f515acd8c6f25a561b9c4e3b04fea",
                    "status": "affected",
                    "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "90bec7cef8805f9a23145e070dff28a02bb584eb",
                    "status": "affected",
                    "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7f1ff1b38a7c8b872382b796023419d87d78c47e",
                    "status": "affected",
                    "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/wangxun/libwx/wx_lib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.88",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.24",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E490AC3E-4FCB-404E-B82F-0DE1390D06A2",
                    "versionEndExcluding": "6.6.88",
                    "versionStartIncluding": "6.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1D35A8A8-F3EC-45E6-AD37-1F154B27529D",
                    "versionEndExcluding": "6.12.24",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4A475784-BF3B-4514-81EE-49C8522FB24A",
                    "versionEndExcluding": "6.13.12",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "483E2E15-2135-4EC6-AB64-16282C5EF704",
                    "versionEndExcluding": "6.14.3",
                    "versionStartIncluding": "6.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: handle page_pool_dev_alloc_pages error\n\npage_pool_dev_alloc_pages could return NULL. There was a WARN_ON(!page)\nbut it would still proceed to use the NULL pointer and then crash.\n\nThis is similar to commit 001ba0902046\n(\"net: fec: handle page_pool_dev_alloc_pages error\").\n\nThis is found by our static analysis tool KNighter."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: libwx: error en el controlador page_pool_dev_alloc_pages. page_pool_dev_alloc_pages podr\u00eda devolver NULL. Se ejecut\u00f3 un WARN_ON(!page), pero segu\u00eda usando el puntero NULL y se bloqueaba. Esto es similar a la confirmaci\u00f3n 001ba0902046 (\"net: fec: error en el controlador page_pool_dev_alloc_pages\"). Esta vulnerabilidad fue detectada por nuestra herramienta de an\u00e1lisis est\u00e1tico Knighter."
          }
        ],
        "id": "CVE-2025-37755",
        "lastModified": "2026-08-04T11:22:42.957",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-05-01T13:15:54.267",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1dd13c60348f515acd8c6f25a561b9c4e3b04fea"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7f1ff1b38a7c8b872382b796023419d87d78c47e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/90bec7cef8805f9a23145e070dff28a02bb584eb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ad81d666e114ebf989fc9994d4c93d451dc60056"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c17ef974bfcf1a50818168b47c4606b425a957c4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:31:19+00:00",
      "cve": "CVE-2025-37755",
      "id": "CVE-2025-37755",
      "initial_release_date": "2025-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: libwx: handle page_pool_dev_alloc_pages error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37755.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.