CVE-2025-37958 is a vulnerability identified in the Linux kernel's memory management subsystem, specifically related to the handling of Transparent Huge Pages (THP) during page migration. The flaw arises when migrating a THP, where concurrent access to the Page Middle Directory (PMD) migration entry during a deferred split scan can lead to dereferencing an invalid address. This occurs because the PMD migration entry may be accessed without proper validation, resulting in an invalid memory access or page fault. The root cause is a missing early check on the PMD migration entry before proceeding with operations that assume its validity. The vulnerability was discovered through syzkaller, a kernel fuzzing tool, and confirmed upstream. The bug manifests as a kernel crash with an inability to handle page faults, as shown in the provided kernel call trace. The fix involves adding a check on the PMD migration entry to return early if it is invalid, avoiding the use of pmd_to_swp_entry and pfn_swap_entry_to_page functions for verification, since the PMD migration entry is locked and cannot be the target of migration. This vulnerability affects Linux kernel versions containing the specified commit hashes, indicating it is present in recent kernel versions prior to the patch. No known exploits are reported in the wild at this time, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions with Transparent Huge Pages enabled, which is common in many enterprise Linux distributions used in servers, cloud infrastructure, and embedded devices. Exploitation could lead to kernel crashes (denial of service) due to invalid memory accesses during page migration, potentially impacting availability of critical services. While there is no direct evidence of privilege escalation or data corruption, kernel crashes can disrupt operations, cause system instability, and require reboots, which is critical for high-availability environments. Organizations relying on Linux-based infrastructure for web services, databases, or virtualization could experience service interruptions. Additionally, embedded systems or IoT devices running affected kernels may be vulnerable to remote or local attacks causing device failures. The lack of known exploits reduces immediate risk, but the vulnerability's presence in the kernel memory management code means it could be targeted in the future. The impact on confidentiality and integrity is limited based on current information, but availability impact is moderate to high depending on the deployment context.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched. Since the issue is in the core kernel memory management, applying vendor-supplied kernel updates or backported patches is essential. For environments where immediate patching is not feasible, consider disabling Transparent Huge Pages (THP) as a temporary mitigation, although this may impact performance. Monitoring kernel logs for page fault errors or crashes related to split_huge_pmd_locked can help detect attempts to trigger this vulnerability. Implementing strict access controls and limiting untrusted code execution on affected systems can reduce exploitation risk. Organizations should also engage with their Linux distribution vendors to confirm patch availability and deployment timelines. For embedded devices, coordinate with hardware vendors for firmware/kernel updates. Finally, maintain robust backup and recovery procedures to minimize downtime in case of exploitation.