CVE-2025-37779 is a vulnerability identified in the Linux kernel related to the handling of folios in the iov_iter subsystem, specifically when using EROFS (Enhanced Read-Only File System) file-backed mounts over v9fs (9P protocol) in QEMU virtualized environments. The root cause is a use-after-free (UAF) condition triggered by improper reference counting of non-slab folios during page coalescing across folio boundaries. In this scenario, pages within bio vectors (bvec) are merged across folio boundaries without correctly incrementing the reference count of all involved folios. This leads to premature freeing of folios, causing a bad page state and potential memory corruption. The vulnerability manifests as a kernel BUG due to a bad page state detected by the PAGE_FLAGS_CHECK_AT_FREE flag, which indicates that a page is being freed while still in use. The call trace provided shows the failure occurs during the release of pages in the p9_release_pages function, which is part of the 9P client implementation used in virtualized environments. The issue is specifically triggered when reading files such as "GoogleExtServicesCn.apk" mounted via EROFS over v9fs in QEMU. This vulnerability can cause kernel crashes (denial of service) and potentially memory corruption, which might be leveraged for privilege escalation or arbitrary code execution if exploited. However, as of the published date, no known exploits are reported in the wild. The vulnerability affects specific Linux kernel versions identified by commit hashes (b9c0e49abfca06f1a109acea834bcfc934f33f76). No CVSS score has been assigned yet, and no patches or mitigation links are provided in the data, indicating that remediation may require applying kernel updates once available or backporting fixes.

For European organizations, this vulnerability poses a significant risk primarily to environments running Linux kernels with the affected versions, especially those utilizing virtualized infrastructures with QEMU and employing EROFS file systems over the 9P protocol. Such configurations are common in cloud service providers, data centers, and enterprises leveraging containerization or virtual machines. The impact includes potential denial of service due to kernel crashes, which can disrupt critical services and operations. More severe exploitation could lead to privilege escalation or arbitrary code execution within the kernel context, compromising system integrity and confidentiality. This is particularly concerning for sectors with high reliance on Linux-based virtualization such as finance, telecommunications, and government institutions in Europe. Additionally, the vulnerability could affect embedded systems or IoT devices running affected Linux kernels, which are prevalent in industrial and critical infrastructure sectors. The lack of known exploits currently reduces immediate risk, but the complexity of the flaw and its presence in core kernel memory management components make it a high-value target for attackers once exploit techniques mature.

1. Immediate mitigation involves updating Linux kernels to versions that include the fix for CVE-2025-37779 once officially released by Linux maintainers or vendors. Monitoring kernel mailing lists and vendor advisories for patches is critical. 2. For environments using QEMU virtualization with EROFS over v9fs, consider disabling or avoiding this specific configuration until patched, as it is the trigger vector for the vulnerability. 3. Employ kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR), Kernel Page Table Isolation (KPTI), and strict memory protections to reduce exploitation likelihood. 4. Implement strict access controls and isolation for virtual machines and containers to limit the impact of potential kernel compromises. 5. Regularly audit and monitor kernel logs for signs of bad page states or kernel BUG messages that could indicate exploitation attempts. 6. For organizations with embedded Linux devices, coordinate with device vendors to obtain patched firmware or kernel updates. 7. Employ runtime security tools capable of detecting anomalous kernel behavior or memory corruption attempts. 8. Prepare incident response plans for potential kernel-level compromises to ensure rapid containment and recovery.