CVE-2025-37900

iommu: Fix two issues in iommu_copy_struct_from_user()

Description

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix two issues in iommu_copy_struct_from_user() In the review for iommu_copy_struct_to_user() helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it: https://lore.kernel.org/all/86881827-8E2D-461C-BDA3-FA8FD14C343C@nvidia.com And Alok pointed out a typo at the same time: https://lore.kernel.org/all/480536af-6830-43ce-a327-adbd13dc3f1d@oracle.com Since both issues were copied from iommu_copy_struct_from_user(), fix them first in the current header.

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/2e303d010722787dc84d94f68d70fe10dfc1b9ea
https://git.kernel.org/stable/c/967d6f0d9a20a1bf15ee7ed881e2d4e532e22709
https://git.kernel.org/stable/c/30a3f2f3e4bd6335b727c83c08a982d969752bc1

Frequently Asked Questions

What is the severity of CVE-2025-37900?: CVE-2025-37900 has not yet been assigned a CVSS score.
How to fix CVE-2025-37900?: To fix CVE-2025-37900, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-37900 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-37900 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-37900?: CVE-2025-37900 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.