Linux Kernel Vulnerability in s390/pci Affects Device Creation

CVE-2025-37974

What is CVE-2025-37974?

A vulnerability has been identified in the Linux kernel's s390/pci subsystem related to the zpci_create_device() function. This flaw arises from a failure to verify that the function returns a valid pointer before it is subsequently dereferenced. If this check is omitted, it could lead to improper handling of device entries within the scan_list, risking undefined behavior and potential system instability. Implementing this critical check is essential to ensure robust device management and prevent potential exploit scenarios.

References