What’s Vulnerable › Vulnerabilities

CVE-2025-37773: virtiofs: add filesystem context source name check

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-01 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem context source name check In certain scenarios, for example, during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an extra check for the source name should be added.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 5.4 before 5.4.293; from 5.5 before 5.10.237; from 5.11 before 5.15.181; from 5.16 before 6.1.135; from 6.2 before 6.6.88; from 6.7 before 6.12.25 — fixed in 5.10.237, 5.15.181, 5.4.293, 6.1.135, 6.12.25, 6.14.4

How to fix

Upgrade to a fixed version: Linux kernel 5.10.237, 5.15.181, 5.4.293, 6.1.135. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/599d1e2a6aecc44acf22fe7ea6f5e84a7e526abe
• https://git.kernel.org/stable/c/5ee09cdaf3414f6c92960714af46d3d90eede2f3
• https://git.kernel.org/stable/c/9d6dcf18a1b49990295ac8a05fd9bdfd27ccbf88
• https://git.kernel.org/stable/c/a648d80f8d9b208beee03a2d9aa690cfacf1d41e
• https://git.kernel.org/stable/c/a94fd938df2b1628da66b498aa0eeb89593bc7a2
• https://git.kernel.org/stable/c/b84f13fdad10a543e2e65bab7e81b3f0bceabd67
• https://git.kernel.org/stable/c/c3e31d613951c299487844c4d1686a933e8ee291
• https://git.kernel.org/stable/c/f6ec52710dc5e156b774cbef5d0f5c99b1c53a80
• https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Get alerted when CVE-2025-37773 or the next vulnerability affects your stack