CVE-2025-37849 Overview
CVE-2025-37849 is a use-after-free vulnerability [CWE-416] in the Linux kernel's KVM subsystem for arm64 architectures. The flaw resides in the virtual Generic Interrupt Controller (vGIC) cleanup path during virtual CPU (vCPU) creation. When kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, the function propagates the error but leaves vGIC vCPU data initialized. This leaks memory when the vCPU is destroyed and can trigger a use-after-free condition if the redistributor device handling walks into the freed vCPU structure.
Critical Impact
A local low-privileged user with access to KVM ioctls on an arm64 host can trigger memory corruption in the kernel, potentially leading to privilege escalation or host compromise.
Affected Products
- Linux Kernel (multiple stable branches prior to fix commits)
- Debian Linux 11.0
- Any distribution shipping vulnerable Linux kernel builds on arm64 hardware
Discovery Timeline
- 2025-05-09 - CVE-2025-37849 published to NVD
- 2025-05 - Debian LTS security announcement released
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-37849
Vulnerability Analysis
The vulnerability exists in the KVM (Kernel-based Virtual Machine) implementation for arm64 systems. During vCPU creation, kvm_arch_vcpu_create() performs several initialization steps, including sharing the vCPU page with the hypervisor and initializing the vGIC vCPU data structures. If the hypervisor page sharing step fails, the function returns the error to the calling ioctl handler without unwinding the already-initialized vGIC state.
This incomplete cleanup creates two distinct problems. First, the vGIC vCPU structures remain allocated after the failed creation, producing a memory leak when the vCPU is torn down. Second, and more serious, subsequent operations on the GIC redistributor device may traverse the stale vGIC state and dereference pointers referring to memory that has been freed elsewhere in the destruction path, resulting in a use-after-free.
Root Cause
The root cause is missing error-path cleanup in kvm_arch_vcpu_create(). The function initializes vGIC vCPU data before attempting to share the vCPU page with the hypervisor. When the share operation fails, the error handling logic does not invoke the corresponding vGIC teardown routine. The upstream fix adds the missing cleanup call so that vGIC vCPU structures are destroyed on any error path.
Attack Vector
Exploitation requires local access to the host with permission to invoke KVM ioctls, typically granted through /dev/kvm. An attacker triggers repeated vCPU creation failures under conditions that cause the hypervisor page-sharing step to fail. Each failure leaves behind partially initialized vGIC state. The attacker then interacts with the GIC redistributor device interface to cause the kernel to dereference the dangling vGIC vCPU pointer. Successful exploitation can corrupt kernel memory and enable local privilege escalation to root or arbitrary code execution in kernel context.
No public proof-of-concept exploit or in-the-wild exploitation has been reported for CVE-2025-37849 at the time of publication.
Detection Methods for CVE-2025-37849
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing vGIC functions or KVM arm64 subsystems in dmesg and /var/log/kern.log
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free events in vGIC redistributor code paths
- Repeated KVM KVM_CREATE_VCPU ioctl failures from unprivileged processes on arm64 hosts
Detection Strategies
- Audit host kernel version against the fixed commits (07476e0d932a, 2480326eba8a, 250f25367b58, 5085e02362b9, c32278961340, f1e9087abaee) to determine exposure.
- Monitor process invocations of KVM ioctls from non-virtualization workloads to identify anomalous vCPU creation activity.
- Correlate kernel crash telemetry with processes holding open file descriptors to /dev/kvm.
Monitoring Recommendations
- Collect and centralize kernel logs from arm64 KVM hosts to detect crashes, oopses, and KASAN reports.
- Track access to /dev/kvm and enumerate the users and containers permitted to invoke KVM ioctls.
- Alert on unexpected virtualization-related syscall patterns originating from user workloads that do not normally run guests.
How to Mitigate CVE-2025-37849
Immediate Actions Required
- Apply vendor-supplied kernel updates on all arm64 hosts running KVM as soon as patched packages are available.
- Restrict access to /dev/kvm to trusted administrators and virtualization service accounts only.
- Inventory arm64 systems providing virtualization services and prioritize patching multi-tenant hosts.
Patch Information
The Linux kernel maintainers resolved the issue by adding vGIC teardown to the error path of kvm_arch_vcpu_create(). Fixes have been backported across stable branches in commits 07476e0d932afc53c05468076393ac35d0b4999e, 2480326eba8ae9ccc5e4c3c2dc8d407db68e3c52, 250f25367b58d8c65a1b060a2dda037eea09a672, 5085e02362b9948f82fceca979b8f8e12acb1cc5, c322789613407647a05ff5c451a7bf545fb34e73, and f1e9087abaeedec9bf2894a282ee4f0d8383f299. Debian users should apply updates referenced in the Debian LTS Security Announcement. See the Linux Kernel Commit Fix for the canonical patch.
Workarounds
- Remove or restrict the kvm group membership so only authorized virtualization users can open /dev/kvm.
- Disable KVM on arm64 hosts that do not require it by unloading the kvm module or blacklisting it in /etc/modprobe.d/.
- Isolate untrusted workloads from hosts providing hardware virtualization until patches are applied.
# Configuration example: restrict /dev/kvm access and verify kernel version
ls -l /dev/kvm
sudo chmod 660 /dev/kvm
sudo chown root:kvm /dev/kvm
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
