CVE-2025-37995: Linux kernel · module: ensure that kobject_put() is safe for module type kobjects
Affects Linux kernelSource CVE Database V5
Not known to be exploited.
Data as of 26 Oct 2026, 08:30 UTC
Rated High by the CNA (Linux) · No CVSS score from NVD or the CNA
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 29 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should: 1) Apply the official Linux kernel patches that address CVE-2025-37995 as soon as they are released and tested in their environments. 2) Restrict the ability to load kernel modules to trusted administrators only, minimizing the risk of malicious or untrusted modules triggering the vulnerability. 3) Implement strict access controls and monitoring on systems that allow kernel module loading, including using security modules like SELinux or AppArmor to enforce policies. 4) Regularly audit and verify kernel module integrity and provenance to prevent unauthorized or vulnerable modules from being loaded. 5) Employ kernel live patching solutions where available to reduce downtime and quickly deploy fixes without full system reboots. 6) Monitor system logs and kernel messages for unusual behavior related to module loading or kobject operations that might indicate exploitation attempts. 7) Educate system administrators about the risks associated with kernel module management and the importance of timely patching.
Description
In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe.
References
- git.kernel.org/stable/c/93799fb988757cdacf19acba57807746c00378e6 (opens in a new tab)
- git.kernel.org/stable/c/a63d99873547d8b39eb2f6db79dd235761e7098a (opens in a new tab)
- git.kernel.org/stable/c/f1c71b4bd721a4ea21da408806964b10468623f2 (opens in a new tab)
- git.kernel.org/stable/c/9e7b49ce4f9d0cb5b6e87db9e07a2fb9e754b0dd (opens in a new tab)
- git.kernel.org/stable/c/faa9059631d3491d699c69ecf512de9e1a3d6649 (opens in a new tab)
- git.kernel.org/stable/c/d63851049f412cdfadaeef7a7eaef5031d11c1e9 (opens in a new tab)
- git.kernel.org/stable/c/31d8df3f303c3ae9115230820977ef8c35c88808 (opens in a new tab)
- git.kernel.org/stable/c/a6aeb739974ec73e5217c75a7c008a688d3d5cf1 (opens in a new tab)