---
id: CVE-2025-37949
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xenbus: Use kref to track req lifetime

  Marek reported seeing a NULL pointer fault in the xenbus_thread
  callstack:
  BUG: kernel NULL pointer dereference, address: 000000…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xenbus: Use kref to track req lifetime

  Marek reported seeing a NULL pointer fault in the xenbus_thread
  callstack:
  BUG: kernel NULL pointer dereference, address: 000000…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.11, < 5.4.294'
  - 'linux_kernel >= 5.5, < 5.10.238'
  - 'linux_kernel >= 5.11, < 5.15.183'
  - 'linux_kernel >= 5.16, < 6.1.139'
  - 'linux_kernel >= 6.2, < 6.6.91'
  - 'linux_kernel >= 6.7, < 6.12.29'
  - 'linux_kernel >= 6.13, < 6.14.7'
  - linux_kernel = 6.15
  - debian_linux = 11.0
patched:
  - linux_kernel 6.14.7
published: '2025-05-20'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:22.450'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-37949'
references:
  - url: 'https://git.kernel.org/stable/c/0e94a246bb6d9538010b6c02d2b1d4717a97b2e5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1f0304dfd9d217c2f8b04a9ef4b3258a66eedd27'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2466b0f66795c3c426cacc8998499f38031dbb59'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d260a5558df4650eb87bc41b2c9ac2d6b2ba447'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8b02f85e84dc6f7c150cef40ddb69af5a25659e5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8e9c8a0393b5f85f1820c565ab8105660f4e8f92'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cbfaf46b88a4c01b64c4186cdccd766c19ae644c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f1bcac367bc95631afbb918348f30dec887d0e1b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.0024
epssPercentile: 0.15072
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:46:21.911402Z'
ingestedAt: '2026-10-15T22:48:25.486Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xenbus: Use kref to track req lifetime

Marek reported seeing a NULL pointer fault in the xenbus_thread
callstack:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: e030:__wake_up_common+0x4c/0x180
Call Trace:
 <TASK>
 __wake_up_common_lock+0x82/0xd0
 process_msg+0x18e/0x2f0
 xenbus_thread+0x165/0x1c0

process_msg+0x18e is req->cb(req).  req->cb is set to xs_wake_up(), a
thin wrapper around wake_up(), or xenbus_dev_queue_reply().  It seems
like it was xs_wake_up() in this case.

It seems like req may have woken up the xs_wait_for_reply(), which
kfree()ed the req.  When xenbus_thread resumes, it faults on the zero-ed
data.

Linux Device Drivers 2nd edition states:
"Normally, a wake_up call can cause an immediate reschedule to happen,
meaning that other processes might run before wake_up returns."
... which would match the behaviour observed.

Change to keeping two krefs on each request.  One for the caller, and
one for xenbus_thread.  Each will kref_put() when finished, and the last
will free it.

This use of kref matches the description in
Documentation/core-api/kref.rst

## Affected

- `linux_kernel >= 4.11, < 5.4.294`
- `linux_kernel >= 5.5, < 5.10.238`
- `linux_kernel >= 5.11, < 5.15.183`
- `linux_kernel >= 5.16, < 6.1.139`
- `linux_kernel >= 6.2, < 6.6.91`
- `linux_kernel >= 6.7, < 6.12.29`
- `linux_kernel >= 6.13, < 6.14.7`
- `linux_kernel = 6.15`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.14.7`