CVE-2025-37996: Linux kernel · KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()
Affects Linux kernelSource CVE Database V5
Not known to be exploited.
Data as of 26 Oct 2026, 10:12 UTC
Rated High by the CNA (Linux) · No CVSS score from NVD or the CNA
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 29 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations should promptly apply the patch that ensures the memcache pointer is always initialized in the user_mem_abort() function within the Linux kernel. Until patches are applied, organizations should restrict access to systems running ARM64 KVM virtualization to trusted users only and monitor for unusual kernel crashes or instability that could indicate exploitation attempts. Employing kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR) and enabling kernel lockdown modes can reduce exploitation likelihood. Additionally, organizations should audit their ARM64 Linux deployments to identify affected kernel versions and prioritize patching in production and development environments. For cloud providers, isolating guest VMs and limiting the ability of untrusted users to deploy ARM64 virtual machines can mitigate risk. Continuous monitoring for suspicious activity and maintaining up-to-date intrusion detection systems tailored for kernel-level anomalies are also recommended.
Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort() Commit fce886a60207 ("KVM: arm64: Plumb the pKVM MMU in KVM") made the initialization of the local memcache variable in user_mem_abort() conditional, leaving a codepath where it is used uninitialized via kvm_pgtable_stage2_map(). This can fail on any path that requires a stage-2 allocation without transition via a permission fault or dirty logging. Fix this by making sure that memcache is always valid.