In the Linux kernel, the following vulnerability has been resolved:
9p/net: fix improper handling of bogus negative read/write replies
In p9clientwrite() and p9clientread_once(), if the server incorrectly replies with success but a negative write/read count then we would consider written (negative) <= rsize (positive) because both variables were signed.
Make variables unsigned to avoid this problem.
The reproducer linked below now fails with the following error instead of a null pointer deref: 9pnet: bogus RWRITE count (4294967295 > 3)
[
{
"digest": {
"length": 1468.0,
"function_hash": "114460096413152869836583749494342888740"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_read_once"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@468ff4a7c61fb811c596a7c44b6a5455e40fd12b",
"id": "CVE-2025-37879-2cf65151",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1468.0,
"function_hash": "114460096413152869836583749494342888740"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_read_once"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@374e4cd75617c8c2552f562f39dd989583f5c330",
"id": "CVE-2025-37879-31b0f53c",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1468.0,
"function_hash": "114460096413152869836583749494342888740"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_read_once"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c548f95688e2b5ae0e2ae43d53cf717156c7d034",
"id": "CVE-2025-37879-5131ada0",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1339.0,
"function_hash": "29250198422865058707534290960865639233"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_readdir"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0259a856afca31d699b706ed5e2adf11086c73b",
"id": "CVE-2025-37879-5572b8bf",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1339.0,
"function_hash": "29250198422865058707534290960865639233"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_readdir"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@374e4cd75617c8c2552f562f39dd989583f5c330",
"id": "CVE-2025-37879-5946e841",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1339.0,
"function_hash": "29250198422865058707534290960865639233"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_readdir"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a68768e280b7d0c967ea509e791bb9b90adc94a5",
"id": "CVE-2025-37879-5dd96d4d",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1468.0,
"function_hash": "114460096413152869836583749494342888740"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_read_once"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0259a856afca31d699b706ed5e2adf11086c73b",
"id": "CVE-2025-37879-7cbb80b5",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"161419440610098606287030099968191621106",
"139974973825919054965985395522160934971",
"245668200290027119039192278617354069319",
"281826073014437364627725125385299798824",
"120620489606201210394715158114460434618",
"331816372562871390599676267546931721147",
"141833029220903074241480230702742005694",
"35349499853640645435007553096392891972",
"101615495333800758185338549814517003480",
"274908781376877935776841499120858684190",
"217524455895346871653381615809871866671",
"116467598970687054689944892224753932142",
"55187213622168142727729542684424219198",
"322008859396323343702570354968736897767",
"198984515767563342427412854968081449197",
"201068591961884940113589484402737610110",
"256477384438525451790839180023255674072",
"45643059372875597192640822659072350789",
"225624619941789935610953649309048586517",
"249428253300907488378871810063277502115",
"97600465508140529667820531512203706109",
"126258416217305280423975242126902930559",
"252666583215928136414767979253387835115",
"200794510615485828493502774334307746822",
"256696154902192105946446393694290609071",
"216718677197812760170487882029804905071",
"215167937914531328501535450663342270672",
"119944469393135723910558302471253992951",
"2581544741486425202377665925571377855",
"50837481672378186714479057414290045406",
"51928647006646438516108566425319351508",
"265740167004684799033755170214392360937",
"212614838462192907748922889807273330948",
"43049632072259587734033511942051634650",
"241159788805617011341411789529334657138",
"278666910890188774802082781245706604629",
"213751467810085899998197386324398702272",
"335223513845413139693162057932681118108",
"225412709856861859756899800410152211305",
"78973194794100775437086540784622956192",
"282992499437665327928030594867707018931",
"14355712218737113688591057885498109291",
"71676919561013720916604954166286616646",
"334450663909288096570358064865363350901",
"98341179219632754885190637946206697575",
"274727731734031018211069719887359518465",
"221511984107801006427458085070920749308"
],
"threshold": 0.9
},
"target": {
"file": "net/9p/client.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@468ff4a7c61fb811c596a7c44b6a5455e40fd12b",
"id": "CVE-2025-37879-7fe51462",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"161419440610098606287030099968191621106",
"139974973825919054965985395522160934971",
"245668200290027119039192278617354069319",
"281826073014437364627725125385299798824",
"120620489606201210394715158114460434618",
"331816372562871390599676267546931721147",
"141833029220903074241480230702742005694",
"35349499853640645435007553096392891972",
"101615495333800758185338549814517003480",
"274908781376877935776841499120858684190",
"217524455895346871653381615809871866671",
"116467598970687054689944892224753932142",
"55187213622168142727729542684424219198",
"322008859396323343702570354968736897767",
"198984515767563342427412854968081449197",
"201068591961884940113589484402737610110",
"256477384438525451790839180023255674072",
"45643059372875597192640822659072350789",
"225624619941789935610953649309048586517",
"249428253300907488378871810063277502115",
"97600465508140529667820531512203706109",
"126258416217305280423975242126902930559",
"252666583215928136414767979253387835115",
"200794510615485828493502774334307746822",
"256696154902192105946446393694290609071",
"216718677197812760170487882029804905071",
"215167937914531328501535450663342270672",
"119944469393135723910558302471253992951",
"2581544741486425202377665925571377855",
"50837481672378186714479057414290045406",
"51928647006646438516108566425319351508",
"265740167004684799033755170214392360937",
"212614838462192907748922889807273330948",
"43049632072259587734033511942051634650",
"241159788805617011341411789529334657138",
"278666910890188774802082781245706604629",
"213751467810085899998197386324398702272",
"335223513845413139693162057932681118108",
"247482917522243524331008667662475883967",
"253741595225839789441269811020168254567",
"282992499437665327928030594867707018931",
"14355712218737113688591057885498109291",
"71676919561013720916604954166286616646",
"334450663909288096570358064865363350901",
"98341179219632754885190637946206697575",
"274727731734031018211069719887359518465",
"221511984107801006427458085070920749308"
],
"threshold": 0.9
},
"target": {
"file": "net/9p/client.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@374e4cd75617c8c2552f562f39dd989583f5c330",
"id": "CVE-2025-37879-8ced42d3",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 1346.0,
"function_hash": "137497787196403425117093664767269730008"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_write"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@468ff4a7c61fb811c596a7c44b6a5455e40fd12b",
"id": "CVE-2025-37879-96f8175b",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1339.0,
"function_hash": "29250198422865058707534290960865639233"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_readdir"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c548f95688e2b5ae0e2ae43d53cf717156c7d034",
"id": "CVE-2025-37879-a2e5928d",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1346.0,
"function_hash": "137497787196403425117093664767269730008"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_write"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c548f95688e2b5ae0e2ae43d53cf717156c7d034",
"id": "CVE-2025-37879-a337620e",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1346.0,
"function_hash": "137497787196403425117093664767269730008"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_write"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@374e4cd75617c8c2552f562f39dd989583f5c330",
"id": "CVE-2025-37879-a8e71cd1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"161419440610098606287030099968191621106",
"139974973825919054965985395522160934971",
"245668200290027119039192278617354069319",
"281826073014437364627725125385299798824",
"120620489606201210394715158114460434618",
"331816372562871390599676267546931721147",
"141833029220903074241480230702742005694",
"35349499853640645435007553096392891972",
"101615495333800758185338549814517003480",
"274908781376877935776841499120858684190",
"217524455895346871653381615809871866671",
"116467598970687054689944892224753932142",
"55187213622168142727729542684424219198",
"322008859396323343702570354968736897767",
"198984515767563342427412854968081449197",
"201068591961884940113589484402737610110",
"256477384438525451790839180023255674072",
"45643059372875597192640822659072350789",
"225624619941789935610953649309048586517",
"249428253300907488378871810063277502115",
"97600465508140529667820531512203706109",
"126258416217305280423975242126902930559",
"252666583215928136414767979253387835115",
"200794510615485828493502774334307746822",
"256696154902192105946446393694290609071",
"216718677197812760170487882029804905071",
"215167937914531328501535450663342270672",
"119944469393135723910558302471253992951",
"2581544741486425202377665925571377855",
"50837481672378186714479057414290045406",
"51928647006646438516108566425319351508",
"265740167004684799033755170214392360937",
"212614838462192907748922889807273330948",
"43049632072259587734033511942051634650",
"241159788805617011341411789529334657138",
"278666910890188774802082781245706604629",
"213751467810085899998197386324398702272",
"335223513845413139693162057932681118108",
"247482917522243524331008667662475883967",
"253741595225839789441269811020168254567",
"282992499437665327928030594867707018931",
"14355712218737113688591057885498109291",
"71676919561013720916604954166286616646",
"334450663909288096570358064865363350901",
"98341179219632754885190637946206697575",
"274727731734031018211069719887359518465",
"221511984107801006427458085070920749308"
],
"threshold": 0.9
},
"target": {
"file": "net/9p/client.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0259a856afca31d699b706ed5e2adf11086c73b",
"id": "CVE-2025-37879-ad029fea",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 1346.0,
"function_hash": "137497787196403425117093664767269730008"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_write"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0259a856afca31d699b706ed5e2adf11086c73b",
"id": "CVE-2025-37879-c11c1549",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"161419440610098606287030099968191621106",
"139974973825919054965985395522160934971",
"245668200290027119039192278617354069319",
"281826073014437364627725125385299798824",
"120620489606201210394715158114460434618",
"331816372562871390599676267546931721147",
"141833029220903074241480230702742005694",
"35349499853640645435007553096392891972",
"101615495333800758185338549814517003480",
"274908781376877935776841499120858684190",
"217524455895346871653381615809871866671",
"116467598970687054689944892224753932142",
"55187213622168142727729542684424219198",
"322008859396323343702570354968736897767",
"198984515767563342427412854968081449197",
"201068591961884940113589484402737610110",
"256477384438525451790839180023255674072",
"45643059372875597192640822659072350789",
"225624619941789935610953649309048586517",
"249428253300907488378871810063277502115",
"97600465508140529667820531512203706109",
"126258416217305280423975242126902930559",
"252666583215928136414767979253387835115",
"200794510615485828493502774334307746822",
"256696154902192105946446393694290609071",
"216718677197812760170487882029804905071",
"215167937914531328501535450663342270672",
"119944469393135723910558302471253992951",
"2581544741486425202377665925571377855",
"50837481672378186714479057414290045406",
"51928647006646438516108566425319351508",
"265740167004684799033755170214392360937",
"212614838462192907748922889807273330948",
"43049632072259587734033511942051634650",
"241159788805617011341411789529334657138",
"278666910890188774802082781245706604629",
"213751467810085899998197386324398702272",
"335223513845413139693162057932681118108",
"247482917522243524331008667662475883967",
"253741595225839789441269811020168254567",
"282992499437665327928030594867707018931",
"14355712218737113688591057885498109291",
"71676919561013720916604954166286616646",
"334450663909288096570358064865363350901",
"98341179219632754885190637946206697575",
"274727731734031018211069719887359518465",
"221511984107801006427458085070920749308"
],
"threshold": 0.9
},
"target": {
"file": "net/9p/client.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a68768e280b7d0c967ea509e791bb9b90adc94a5",
"id": "CVE-2025-37879-c4de2ab8",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 1349.0,
"function_hash": "278124660681029463997364323141722507999"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_readdir"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@468ff4a7c61fb811c596a7c44b6a5455e40fd12b",
"id": "CVE-2025-37879-cf31283b",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 1346.0,
"function_hash": "137497787196403425117093664767269730008"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_write"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a68768e280b7d0c967ea509e791bb9b90adc94a5",
"id": "CVE-2025-37879-d0074ebc",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"161419440610098606287030099968191621106",
"139974973825919054965985395522160934971",
"245668200290027119039192278617354069319",
"281826073014437364627725125385299798824",
"120620489606201210394715158114460434618",
"331816372562871390599676267546931721147",
"141833029220903074241480230702742005694",
"35349499853640645435007553096392891972",
"101615495333800758185338549814517003480",
"274908781376877935776841499120858684190",
"217524455895346871653381615809871866671",
"116467598970687054689944892224753932142",
"55187213622168142727729542684424219198",
"322008859396323343702570354968736897767",
"198984515767563342427412854968081449197",
"201068591961884940113589484402737610110",
"256477384438525451790839180023255674072",
"45643059372875597192640822659072350789",
"225624619941789935610953649309048586517",
"249428253300907488378871810063277502115",
"97600465508140529667820531512203706109",
"126258416217305280423975242126902930559",
"252666583215928136414767979253387835115",
"200794510615485828493502774334307746822",
"256696154902192105946446393694290609071",
"216718677197812760170487882029804905071",
"215167937914531328501535450663342270672",
"119944469393135723910558302471253992951",
"2581544741486425202377665925571377855",
"50837481672378186714479057414290045406",
"51928647006646438516108566425319351508",
"265740167004684799033755170214392360937",
"212614838462192907748922889807273330948",
"43049632072259587734033511942051634650",
"241159788805617011341411789529334657138",
"278666910890188774802082781245706604629",
"213751467810085899998197386324398702272",
"335223513845413139693162057932681118108",
"247482917522243524331008667662475883967",
"253741595225839789441269811020168254567",
"282992499437665327928030594867707018931",
"14355712218737113688591057885498109291",
"71676919561013720916604954166286616646",
"334450663909288096570358064865363350901",
"98341179219632754885190637946206697575",
"274727731734031018211069719887359518465",
"221511984107801006427458085070920749308"
],
"threshold": 0.9
},
"target": {
"file": "net/9p/client.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c548f95688e2b5ae0e2ae43d53cf717156c7d034",
"id": "CVE-2025-37879-d5ff3b2c",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 1468.0,
"function_hash": "114460096413152869836583749494342888740"
},
"target": {
"file": "net/9p/client.c",
"function": "p9_client_read_once"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a68768e280b7d0c967ea509e791bb9b90adc94a5",
"id": "CVE-2025-37879-f4777bfc",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]