Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-37819
CVE-2025-37819:
Linux Kernel vulnerability analysis and mitigation
Overview
A use-after-free vulnerability has been identified in the Linux kernel's irqchip/gic-v2m component, specifically affecting the gicv2mgetfwnode() function. The vulnerability was discovered and assigned CVE-2025-37819, with the initial disclosure date being April 16, 2025. The issue affects systems using ACPI where the function is registered with the PCI subsystem as pcimsigetfwnodecb() (CVE Details, NVD).
Technical details
The vulnerability occurs because the gicv2mgetfwnode() callback is incorrectly marked as __init, causing it to be freed while still being registered with the PCI subsystem. This can lead to a kernel paging request failure at virtual address ffff8000816c0400 during a PCI host bridge probe. The issue is reproducible on Juno boards with ACPI boot (CVE Details).
Impact
When exploited, this vulnerability can cause the kernel to fail when handling paging requests, potentially leading to system instability or crashes. The issue specifically affects the PCI subsystem's ability to properly handle host bridge probing operations (NVD).
Mitigation and workarounds
The vulnerability has been resolved by retaining the gicv2mgetfwnode() function for later use instead of marking it as __init. A fix has been implemented in the Linux kernel (CVE Details).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management