CVE-2025-37879

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-37879
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37879.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-37879
Downstream
Related
Published
2025-05-09T06:45:43.197Z
Modified
2026-03-11T07:55:04.149674Z
Summary
9p/net: fix improper handling of bogus negative read/write replies
Details

In the Linux kernel, the following vulnerability has been resolved:

9p/net: fix improper handling of bogus negative read/write replies

In p9clientwrite() and p9clientread_once(), if the server incorrectly replies with success but a negative write/read count then we would consider written (negative) <= rsize (positive) because both variables were signed.

Make variables unsigned to avoid this problem.

The reproducer linked below now fails with the following error instead of a null pointer deref: 9pnet: bogus RWRITE count (4294967295 > 3)

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37879.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
070b3656cf228eaaef7b28b59264c5c7cdbdd0fb
Fixed
468ff4a7c61fb811c596a7c44b6a5455e40fd12b
Fixed
a68768e280b7d0c967ea509e791bb9b90adc94a5
Fixed
c548f95688e2b5ae0e2ae43d53cf717156c7d034
Fixed
374e4cd75617c8c2552f562f39dd989583f5c330
Fixed
d0259a856afca31d699b706ed5e2adf11086c73b

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37879.json"