CVE-2025-37974: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-37974) was discovered in the Linux kernel's s390/pci subsystem, specifically related to missing error checks. The issue was disclosed on May 20, 2025, affecting the zpcicreatedevice() function which returns an error pointer that requires validation before being dereferenced as a struct zpci_dev pointer (NVD Detail, Wiz Report).

The vulnerability stems from a missing check for zpcicreatedevice() error return in the _clpadd() function. The issue was introduced when adding the scanlist functionality in a previous commit. The function returns an error pointer that should be validated before being dereferenced as a struct zpcidev pointer. Red Hat has assigned this vulnerability a CVSS v3.1 score of 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Red Hat).

When exploited, the vulnerability can lead to system instability or crashes due to dereferencing invalid pointers. The impact is primarily related to the system's handling of PCI devices on s390 architecture (Wiz Report).

The vulnerability has been addressed by adding the missing check in _clpadd() where it was previously overlooked when adding the scan_list functionality. The fix ensures proper validation of the error pointer before dereferencing (NVD Detail).