CVE-2025-37981 – A memory corruption vulnerability in the Linux ... (How to Fix)

Q: What is the severity of CVE-2025-37981?

CVE-2025-37981 has a CVSS score of 7.8 (HIGH). A memory corruption vulnerability in the Linux kernel's smartpqi SCSI driver could allow attackers to write driver logs to system memory after kexec reboots. This affects Linux systems using the smartpqi driver for HPE Smart Array controllers. The vulnerability could lead to system instability or potential privilege escalation.

📋 TL;DR

A memory corruption vulnerability in the Linux kernel's smartpqi SCSI driver could allow attackers to write driver logs to system memory after kexec reboots. This affects Linux systems using the smartpqi driver for HPE Smart Array controllers. The vulnerability could lead to system instability or potential privilege escalation.

💻 Affected Systems

Products:

Linux kernel with smartpqi driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires smartpqi driver to be loaded and used with HPE Smart Array controllers. Systems performing kexec operations are most vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Memory corruption could lead to kernel panic, system crashes, or potential privilege escalation allowing attackers to execute arbitrary code with kernel privileges.

🟠

Likely Case

System instability, crashes during kexec reboots, or reduced performance due to incorrect driver parameter settings.

🟢

If Mitigated

Minor performance impact with properly configured systems and updated kernels.

🌐 Internet-Facing: LOW - Requires local access to the system and ability to trigger kexec operations.

🏢 Internal Only: MEDIUM - Could be exploited by authenticated users with sufficient privileges to perform kexec operations on affected systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger kexec operations. The vulnerability was discovered during kexec reboot testing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 7cc670e8ebaa5241dd99c0ad75eceb8f8f64f607, a2d5a0072235a69749ceb04c1a26dc75df66a31a, or ebf673c76ce91e612a882dfaa9a3824962994aae

Vendor Advisory: https://git.kernel.org/stable/c/7cc670e8ebaa5241dd99c0ad75eceb8f8f64f607

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot the system to load the patched kernel. 3. Verify the smartpqi driver is using the updated kernel module.

🔧 Temporary Workarounds

Disable smartpqi driver

linux

Temporarily disable the smartpqi driver if not required for system operation

echo 'blacklist smartpqi' > /etc/modprobe.d/blacklist-smartpqi.conf
rmmod smartpqi

Avoid kexec operations

linux

Prevent use of kexec reboot functionality on affected systems

chmod 000 /sys/kernel/kexec_loaded
echo 0 > /proc/sys/kernel/kexec_load_disabled

🧯 If You Can't Patch

Restrict user permissions to prevent kexec operations
Monitor system logs for kexec-related activities and memory corruption warnings

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if smartpqi module is loaded: lsmod | grep smartpqi && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and check dmesg for smartpqi driver initialization without errors

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Memory corruption warnings in dmesg
smartpqi driver initialization errors
kexec-related system events

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kernel" AND ("smartpqi" OR "kexec") AND ("panic" OR "corruption" OR "Oops")

📊 Metadata

CVE ID: CVE-2025-37981

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

EPSS Score: 0.02% exploit probability (5.5th percentile)

Published: May 20, 2025

Last Updated: November 14, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-37981, you might also want to check these: