CVE-2025-37751: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37751 is a vulnerability discovered in the Linux kernel's x86/cpu subsystem, disclosed on May 1, 2025. The issue involves a NULL array terminator that was incorrectly removed during the switch from x86_cpu_desc to x86_cpu_id in the AMD erratum table handling code (NVD, Wiz).

The vulnerability stems from a code modification where the NULL array terminator at the end of erratum_1386_microcode was removed during a transition between data structures. This removal causes array bound violations when readers attempt to process the erratum table, as they continue past the intended end of the array. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

When exploited, this vulnerability could lead to array bounds violations in the Linux kernel's CPU handling code, potentially causing system instability or crashes when processing AMD CPU erratum information (Wiz).

The fix involves replacing the NULL terminator that was inadvertently removed, ensuring proper array bounds checking when processing the AMD erratum table. Users are advised to update their Linux kernel to a version containing this fix (Wiz, Ubuntu).