SB20250502302 - Input validation error in Linux kernel mctp
Published: May 2, 2025 Updated: May 10, 2025
Security Bulletin ID
SB20250502302
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2025-37790)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the mctp_sk_hash() function in net/mctp/af_mctp.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/3f899bd6dd56ddc46509b526e23a8f0a97712a6d
- https://git.kernel.org/stable/c/52024cd6ec71a6ca934d0cc12452bd8d49850679
- https://git.kernel.org/stable/c/5c1313b93c8c2e3904a48aa88e2fa1db28c607ae
- https://git.kernel.org/stable/c/a8a3b61ce140e2b0a72a779e8d70f60c0cf1e47a
- https://git.kernel.org/stable/c/b9764ebebb007249fb733a131b6110ff333b6616
- https://git.kernel.org/stable/c/e3b5edbdb45924a7d4206d13868a2aac71f1e53d
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14.4