CVE-2025-37879
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In the Linux kernel's 9p/net module, a vulnerability was found in handling negative read/write replies. A server can reply with success but a negative byte count, causing comparison errors and potential NULL pointer dereference.
Risk Assessment
The organization is at risk of system crashes caused by a malicious 9p server sending bogus replies.
Recommendation
Update the Linux kernel to a version containing the fix that makes variables unsigned to avoid negative value issues.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9_client_write() and p9_client_read_once(), if the server incorrectly replies with success but a negative write/read count then we would consider written (negative) <= rsize (positive) because both variables were signed. Make variables unsigned to avoid this problem. The reproducer linked below now fails with the following error instead of a null pointer deref: 9pnet: bogus RWRITE count (4294967295 > 3)