CVE-2025-37949

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xenbus: Use kref to track req lifetime

Marek reported seeing a NULL pointer fault in the xenbus_thread

callstack:

BUG: kernel NULL pointer dereference, address: 0000000000000000

RIP: e030:__wake_up_common+0x4c/0x180

Call Trace:

<TASK>

__wake_up_common_lock+0x82/0xd0

process_msg+0x18e/0x2f0

xenbus_thread+0x165/0x1c0

process_msg+0x18e is req->cb(req). req->cb is set to xs_wake_up(), a

thin wrapper around wake_up(), or xenbus_dev_queue_reply(). It seems

like it was xs_wake_up() in this case.

It seems like req may have woken up the xs_wait_for_reply(), which

kfree()ed the req. When xenbus_thread resumes, it faults on the zero-ed

data.

Linux Device Drivers 2nd edition states:

"Normally, a wake_up call can cause an immediate reschedule to happen,

meaning that other processes might run before wake_up returns."

... which would match the behaviour observed.

Change to keeping two krefs on each request. One for the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References