{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/amd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b518f73f1b6f59e083ec33dea22d9a1a275a970",
              "status": "affected",
              "version": "f3f3251526739bb975b97f840c56b3054dba8638",
              "versionType": "git"
            },
            {
              "lessThan": "f0df00ebc57f803603f2a2e0df197e51f06fbe90",
              "status": "affected",
              "version": "f3f3251526739bb975b97f840c56b3054dba8638",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/amd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.3",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cpu: Avoid running off the end of an AMD erratum table\n\nThe NULL array terminator at the end of erratum_1386_microcode was\nremoved during the switch from x86_cpu_desc to x86_cpu_id. This\ncauses readers to run off the end of the array.\n\nReplace the NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overrunning scan is reached only via `identify_cpu()` during boot-CPU init or secondary-CPU bring-up (`common.c:1887`, `common.c:2009`); no network packet, remote peer data, or adjacent-network frame reaches this path.\nAC:L - On any Zen1/Zen2 part not matched by the two valid entries \u2014 the overwhelming majority of affected hardware \u2014 the scan deterministically crosses the array boundary on every CPU init, with no race, timing window, or attacker-independent precondition.\nPR:L - There is no capability, namespace, or authentication check on the path \u2014 `fix_erratum_1386()` runs automatically during CPU initialization; conservatively a basic local foothold suffices rather than init-namespace root.\nUI:N - The out-of-bounds walk occurs autonomously during CPU initialization; no victim must mount media, open a file, or take any other action.\nS:U - The invalid read and its consequences stay entirely within the affected kernel\u0027s own security authority; no guest-to-host, IOMMU, or sandbox boundary is crossed.\nC:H - The missing sentinel makes the read source-unbounded \u2014 the loop consumes adjacent kernel `.rodata` and beyond with no length check, matching the CWE-125/C:H classification applied to the identical prior defect in this same table (CVE-2024-56721).\nI:N - The overrun is purely a read; no out-of-bounds-derived value is used as a write address or control-flow target, and the only downstream effect is a build-dependent, non-attacker-steerable decision about clearing `X86_FEATURE_XSAVES`.\nA:H - KASAN flags the access as a global-out-of-bounds, and `panic_on_warn` or `kasan.fault=panic` converts it into a kernel panic during boot or CPU bring-up; an unterminated walk reaching unmapped memory faults in the same early context, leaving the system unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:15.932Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b518f73f1b6f59e083ec33dea22d9a1a275a970"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0df00ebc57f803603f2a2e0df197e51f06fbe90"
        }
      ],
      "title": "x86/cpu: Avoid running off the end of an AMD erratum table",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37751",
    "datePublished": "2025-05-01T12:55:56.624Z",
    "dateReserved": "2025-04-16T04:51:23.937Z",
    "dateUpdated": "2026-08-05T11:57:15.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}