CVE-2025-37957

Q: What is the severity of CVE-2025-37957?

CVE-2025-37957 has a CVSS score of 7.8 (HIGH). A Linux kernel vulnerability in KVM's SVM (Secure Virtual Machine) implementation where a triple fault occurring while a vCPU is in System Management Mode (SMM) triggers a WARN and potential instability. This affects systems running KVM virtualization with AMD SVM enabled. The issue was discovered through fuzzing and could lead to denial of service or use-after-free scenarios.

7.8 HIGH

Denial of Service

📋 TL;DR

A Linux kernel vulnerability in KVM's SVM (Secure Virtual Machine) implementation where a triple fault occurring while a vCPU is in System Management Mode (SMM) triggers a WARN and potential instability. This affects systems running KVM virtualization with AMD SVM enabled. The issue was discovered through fuzzing and could lead to denial of service or use-after-free scenarios.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with KVM support

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with AMD SVM virtualization enabled and KVM in use. Intel-based systems are not affected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash leading to denial of service, potentially allowing use-after-free exploitation for privilege escalation.

🟠

Likely Case

Kernel warning messages and VM instability, potentially causing guest VM crashes or host kernel warnings.

🟢

If Mitigated

Minor performance impact from WARN triggers with proper kernel hardening and isolation.

🌐 Internet-Facing: LOW - Requires local access to KVM interfaces or compromised guest VM.

🏢 Internal Only: MEDIUM - Cloud providers, virtualization hosts, and development systems using KVM with AMD CPUs are at risk.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires ability to trigger specific SMM and triple fault conditions through KVM interfaces. Found via Syzkaller fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel commits: a2620f8932fa, d362b21fefce, e9b28bc65fd3, ec24e62a1dd3

Vendor Advisory: https://git.kernel.org/stable/c/a2620f8932fa9fdabc3d78ed6efb004ca409019f

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable KVM SVM

linux

Disable AMD SVM virtualization if not required

Add 'kvm-amd.disable_svm=1' to kernel boot parameters in /etc/default/grub

Restrict KVM access

linux

Limit access to /dev/kvm device to trusted users only

chmod 660 /dev/kvm
chown root:kvm /dev/kvm

🧯 If You Can't Patch

Isolate KVM hosts from untrusted networks
Implement strict access controls for KVM management interfaces

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if KVM SVM is active: 'cat /proc/cpuinfo | grep svm' and 'lsmod | grep kvm'

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commits: 'uname -r' and verify with distribution patch notes

📡 Detection & Monitoring

Log Indicators:

Kernel WARN messages about kvm_vcpu_reset
Triple fault errors in KVM logs
SMM-related warnings in dmesg

Network Indicators:

Unusual KVM management traffic patterns

SIEM Query:

source="kernel" AND "WARNING.*kvm_vcpu_reset" OR "SMM.*SHUTDOWN"

📊 Metadata

CVE ID: CVE-2025-37957

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.03% exploit probability (6.3th percentile)

Published: May 20, 2025

Last Updated: November 14, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable KVM SVM

Restrict KVM access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities