CVE-2025-37898

Source
https://cve.org/CVERecord?id=CVE-2025-37898
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37898.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-37898
Downstream
Published
2025-05-20T15:21:34Z
Modified
2026-08-12T03:30:18Z
Summary
powerpc64/ftrace: fix module loading without patchable function entries
Details

In the Linux kernel, the following vulnerability has been resolved:

powerpc64/ftrace: fix module loading without patchable function entries

get_stubs_size assumes that there must always be at least one patchable function entry, which is not always the case (modules that export data but no code), otherwise it returns -ENOEXEC and thus the section header sh_size is set to that value. During module_memory_alloc() the size is passed to execmem_alloc() after being page-aligned and thus set to zero which will cause it to fail the allocation (and thus module loading) as __vmalloc_node_range() checks for zero-sized allocs and returns null:

[ 115.466896] module_64: cast_common: doesn't contain __patchable_function_entries. [ 115.469189] ------------[ cut here ]------------ [ 115.469496] WARNING: CPU: 0 PID: 274 at mm/vmalloc.c:3778 __vmalloc_node_range_noprof+0x8b4/0x8f0 ... [ 115.478574] ---[ end trace 0000000000000000 ]--- [ 115.479545] execmem: unable to allocate memory

Fix this by removing the check completely, since it is anyway not helpful to propagate this as an error upwards.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37898.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
eec37961a56aa4f3fe1c33ffd48eec7d1bb0c009
Fixed
358b559afec7806b9d01c2405b490e782c347022
Fixed
534f5a8ba27863141e29766467a3e1f61bcb47ac

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37898.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.14.6

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37898.json"