Menu

Star on GitHub · 3.4k

CVE-2025-37833

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads Fix niu_try_msix() to not cause a fatal trap on sparc sys…

Published May 8, 2025EPSS 0.19%

Overview

CVE-2025-37833 is a medium-severity vulnerability. It was published on May 8, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads

Fix niu_try_msix() to not cause a fatal trap on sparc systems.

Set PCI_DEV_FLAGS_MSIX_TOUCH_ENTRY_DATA_FIRST on the struct pci_dev to

work around a bug in the hardware or firmware.

For each vector entry in the msix table, niu chips will cause a fatal

trap if any registers in that entry are read before that entries'

ENTRY_DATA register is written to. Testing indicates writes to other

registers are not sufficient to prevent the fatal trap, however the value

does not appear to matter. This only needs to happen once after power up,

so simply rebooting into a kernel lacking this fix will NOT cause the

trap.

NON-RESUMABLE ERROR: Reporting on cpu 64

NON-RESUMABLE ERROR: TPC [0x00000000005f6900] <msix_prepare_msi_desc+0x90/0xa0>

NON-RESUMABLE ERROR: RAW [4010000000000016:00000e37f93e32ff:0000000202000080:ffffffffffffffff

NON-RESUMABLE ERROR: 000000

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Frequently asked questions

What is CVE-2025-37833?

CVE-2025-37833 is a medium-severity vulnerability. It was published on May 8, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-37833?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2025-37833?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2025-37833?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2025-37833 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2025

View all
LiveWatch live →