Memory Initialization Issue in Linux Kernel on KVM Arm64

CVE-2025-37996

What is CVE-2025-37996?

In the Linux kernel, a vulnerability was identified within the KVM component for arm64 architectures relating to the uninitialized memory cache pointer used in the user_mem_abort() function. A code change intended to integrate the pKVM MMU inadvertently allowed pathways where the local memcache variable was utilized without proper initialization. This oversight poses risks during operations that necessitate stage-2 allocations, particularly when permissions or dirty logging are involved. The resolution ensures that the memcache is consistently valid, preventing potential failures.

References