CVE-2025-37738: linux kernel before 5.4.293 (exclusive), from 5.5 (inclusive), before 5.10.237 (exclusive), from 5.11 (inclusive)…

Affected technology

linux kernel · before 5.4.293 (exclusive)
linux

linux kernel · from 5.5 (inclusive), before 5.10.237 (exclusive)
linux

linux kernel · from 5.11 (inclusive), before 5.15.181 (exclusive)
linux

linux kernel · from 5.16 (inclusive), before 6.1.135 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.88 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.12.24 (exclusive)
linux

linux kernel · from 6.13 (inclusive), before 6.13.12 (exclusive)
linux

linux kernel · from 6.14 (inclusive), before 6.14.3 (exclusive)
linux

debian linux · 11.0
debian

Linux · e50e5129f384ae282adebfb561189cdb19b81cee to before 6aff941cb0f7d0c897c3698ad2e30672709135e3, e50e5129f384ae282adebfb561189cdb19b81cee to before 76c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3, e50e5129f384ae282adebfb561189cdb19b81cee to before f737418b6de31c962c7192777ee4018906975383, e50e5129f384ae282adebfb561189cdb19b81cee to before cf9291a3449b04688b81e32621e88de8f4314b54, e50e5129f384ae282adebfb561189cdb19b81cee to before 362a90cecd36e8a5c415966d0b75b04a0270e4dd, e50e5129f384ae282adebfb561189cdb19b81cee to before eb59cc31b6ea076021d14b04e7faab1636b87d0e, e50e5129f384ae282adebfb561189cdb19b81cee to before 3bc6317033f365ce578eb6039445fb66162722fd, e50e5129f384ae282adebfb561189cdb19b81cee to before 836e625b03a666cf93ff5be328c8cb30336db872, e50e5129f384ae282adebfb561189cdb19b81cee to before c8e008b60492cf6fd31ef127aea6d02fd3d314cd
Linux

Linux · 4.13
Linux

Component: Not specified by the source
File: fs/ext4/xattr.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.