CVE-2025-37978: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37978 is a vulnerability discovered in the Linux kernel related to block integrity handling. The vulnerability was disclosed on May 20, 2025, affecting the block subsystem's handling of protection information buffers (NVD, RedHat).

The vulnerability occurs when multiple protection information buffers are placed inside the same page, leading to potential system crashes (oopses) due to improper handling of set_page_dirty_lock() calls in interrupt context. The issue stems from unnecessarily calling set_page_dirty_lock() on protection information buffers that are not backed by files. The vulnerability has been assigned a CVSS v3.1 base score of 7.0 with a vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (RedHat).

The vulnerability can lead to system crashes when handling block integrity operations, particularly affecting systems that utilize protection information buffers. The impact is primarily focused on system stability and availability (NVD).

The vulnerability requires local access and has high attack complexity. An attacker would need low privileges to exploit this vulnerability, but no user interaction is required (RedHat).

The vulnerability has been resolved by removing the call to set_page_dirty_lock() and the last argument to bio_integrity_unpin_bvec(). Red Hat Enterprise Linux 10 and 9 have fixes deferred, while versions 6, 7, and 8 are not affected (RedHat).