{"id":"CVE-2025-37859","title":"page_pool: avoid infinite loop to schedule delayed worker","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: avoid infinite loop to schedule delayed worker\n\nWe noticed the kworker in page_pool_release_retry() was waken\nup repeatedly and infinitely in production beca…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 05f646cb2174d1a4e032b60b99097f5c4b522616 < c3c7c57017ce1d4b2d3788c1fc59e7e39026e158","Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 9f71db4fb82deb889e0bac4a51b34daea7d506a3","Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 91522aba56e9fcdf64da25ffef9b27f8fad48e0f","Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 90e089a64504982f8d62f223027cb9f903781f78","Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 95f17738b86fd198924d874a5639bcdc49c7e5b8","Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 7204335d1991c23fc615ab76f31f175748a578e1","Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < e74e5aa33228c5e2cb4fc80ad103541a7b7805ec","Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 738d1812ec2e395e953258aea912ddd867d11a13","Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 43130d02baa137033c25297aaae95fd0edc41654","Linux bf22306d92ca59c59dc4aa3bab14768948193d56","Linux >= 5.4.5 < 5.4.293","Linux >= 5.3.18 < 5.4","Linux 5.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:42:33.230277Z"},"published":"2025-05-09","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:52:05.792Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-37859","references":[{"url":"https://git.kernel.org/stable/c/c3c7c57017ce1d4b2d3788c1fc59e7e39026e158"},{"url":"https://git.kernel.org/stable/c/9f71db4fb82deb889e0bac4a51b34daea7d506a3"},{"url":"https://git.kernel.org/stable/c/91522aba56e9fcdf64da25ffef9b27f8fad48e0f"},{"url":"https://git.kernel.org/stable/c/90e089a64504982f8d62f223027cb9f903781f78"},{"url":"https://git.kernel.org/stable/c/95f17738b86fd198924d874a5639bcdc49c7e5b8"},{"url":"https://git.kernel.org/stable/c/7204335d1991c23fc615ab76f31f175748a578e1"},{"url":"https://git.kernel.org/stable/c/e74e5aa33228c5e2cb4fc80ad103541a7b7805ec"},{"url":"https://git.kernel.org/stable/c/738d1812ec2e395e953258aea912ddd867d11a13"},{"url":"https://git.kernel.org/stable/c/43130d02baa137033c25297aaae95fd0edc41654"}],"tags":["cve.org"],"epss":0.00311,"epssPercentile":0.24169,"ingestedAt":"2026-11-05T22:38:31.887Z","slug":"CVE-2025-37859","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npage_pool: avoid infinite loop to schedule delayed worker\n\nWe noticed the kworker in page_pool_release_retry() was waken\nup repeatedly and infinitely in production because of the\nbuggy driver causing the inflight less than 0 and warning\nus in page_pool_inflight()[1].\n\nSince the inflight value goes negative, it means we should\nnot expect the whole page_pool to get back to work normally.\n\nThis patch mitigates the adverse effect by not rescheduling\nthe kworker when detecting the inflight negative in\npage_pool_release_retry().\n\n[1]\n[Mon Feb 10 20:36:11 2025] ------------[ cut here ]------------\n[Mon Feb 10 20:36:11 2025] Negative(-51446) inflight packet-pages\n...\n[Mon Feb 10 20:36:11 2025] Call Trace:\n[Mon Feb 10 20:36:11 2025]  page_pool_release_retry+0x23/0x70\n[Mon Feb 10 20:36:11 2025]  process_one_work+0x1b1/0x370\n[Mon Feb 10 20:36:11 2025]  worker_thread+0x37/0x3a0\n[Mon Feb 10 20:36:11 2025]  kthread+0x11a/0x140\n[Mon Feb 10 20:36:11 2025]  ? process_one_work+0x370/0x370\n[Mon Feb 10 20:36:11 2025]  ? __kthread_cancel_work+0x40/0x40\n[Mon Feb 10 20:36:11 2025]  ret_from_fork+0x35/0x40\n[Mon Feb 10 20:36:11 2025] ---[ end trace ebffe800f33e7e34 ]---\nNote: before this patch, the above calltrace would flood the\ndmesg due to repeated reschedule of release_dw kworker.\n\n## Affected\n\n- `Linux >= 05f646cb2174d1a4e032b60b99097f5c4b522616 < c3c7c57017ce1d4b2d3788c1fc59e7e39026e158`\n- `Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 9f71db4fb82deb889e0bac4a51b34daea7d506a3`\n- `Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 91522aba56e9fcdf64da25ffef9b27f8fad48e0f`\n- `Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 90e089a64504982f8d62f223027cb9f903781f78`\n- `Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 95f17738b86fd198924d874a5639bcdc49c7e5b8`\n- `Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 7204335d1991c23fc615ab76f31f175748a578e1`\n- `Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < e74e5aa33228c5e2cb4fc80ad103541a7b7805ec`\n- `Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 738d1812ec2e395e953258aea912ddd867d11a13`\n- `Linux >= c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 < 43130d02baa137033c25297aaae95fd0edc41654`\n- `Linux bf22306d92ca59c59dc4aa3bab14768948193d56`\n- `Linux >= 5.4.5 < 5.4.293`\n- `Linux >= 5.3.18 < 5.4`\n- `Linux 5.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}