CVE-2025-37975: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37975 is a vulnerability discovered in the Linux kernel's RISC-V module implementation, identified and published on May 20, 2025. The vulnerability affects various Linux distributions, particularly impacting newer versions while older releases remain unaffected (NVD, Wiz).

The vulnerability stems from a code issue in the RISC-V module where rel[j] could access one element past the end of the relocation section. The fix involves simplifying to num_relocations, which is equivalent to the existing size expression. Red Hat has assigned this vulnerability a CVSS 3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat XML).

The vulnerability could potentially lead to out-of-bounds memory access in the Linux kernel's RISC-V module, which might result in system instability or potential security implications. The impact is primarily focused on system availability, as indicated by the CVSS metrics showing high impact on availability but no impact on confidentiality or integrity (Red Hat XML, Wiz).

The vulnerability has been patched in the Linux kernel. Ubuntu has marked this as a medium priority issue and is actively working on fixes for versions 24.04, 24.10, and 25.04, while versions 22.04 LTS and earlier are not affected. Red Hat Enterprise Linux versions 6 through 10 are not affected by this vulnerability (Ubuntu, Red Hat XML).