Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0027 19.0 —
AFFECTED Product Versions Fixed Linux 45d76f492938cdc27ddadc16e1e75103f4cfbf56 – — Linux 6.4 – 6.6.89
TIMELINE Apr 16 Reserved by Linux May 9 Published (CNA: Linux) Jul 30 RESCORED — CVE-2025-37887 (Linux). CVSS 7.1 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command the driver might at the least print garbage and at the worst crash when the user runs the "devlink dev info" devlink command. This happens because the stack variable fw_list is not 0 initialized which results in fw_list.num_fw_slots being a garbage value from the stack. Then the driver tries to access fw_list.fw_names[i] with i >= ARRAY_SIZE and runs off the end of the array. Fix this by initializing the fw_list and by not failing completely if the devcmd fails because other useful information is printed via devlink dev info even if the devcmd fails.
| Date | Event | Detail |
|---|---|---|
| April 16, 2025 | Reserved | Reserved by Linux |
| May 9, 2025 | Published | Published (CNA: Linux) |
| July 30, 2026 | RESCORED | RESCORED — CVE-2025-37887 (Linux). CVSS 7.1 → 5.5 (NVD). |
Authoritative record: CVE-2025-37887 at cve.org
Vendors: linux
Weaknesses: CWE-908
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-37887 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.