CVE-2025-37933

What it actually does

Use-after-free in the octeon_ep network driver caused by calling the device-specific ndo_stop function twice (once on heartbeat loss, again on driver unload) which frees the same resources a second time.

Why it matters to the business

Unpatched systems risk kernel panics or host hangs during device reboots or driver unload, leading to unplanned downtime and requiring emergency reboots or rollbacks across large Linux fleets.

How an attack unfolds

An attacker with local access triggers loss of heartbeat messages from the device, causing the driver to invoke ndo_stop and free resources; subsequently unloading the driver calls ndo_stop again on already-freed memory, resulting in a use-after-free condition that can hang the host.

How to fix it

Upgrade the affected Ubuntu packages to the listed fixed versions (for example linux 3.11.0-12.19 on 14.04 LTS, linux-aws 4.4.0-1002.2 on 14.04 LTS, linux 4.4.0-2.16 on 16.04 LTS, linux 4.13.0-16.19 on 18.04 LTS, and linux-aws-5.15 5.15.0-1073.79~20.04.1 on 20.04 LTS) and reboot.

How to confirm the fix worked

Verify the running kernel package version matches or exceeds the fixed version for each distribution; confirm the octeon_ep driver no longer calls ndo_stop directly during unload after heartbeat loss.

Typical attack path

1. Gain local access or ability to trigger device heartbeat loss
2. Force the driver to call ndo_stop and free resources
3. Unload the driver module to invoke ndo_stop a second time
4. Trigger the resulting use-after-free to induce host hang or kernel instability

How to detect it

Review kernel logs for repeated ndo_stop calls or double-free warnings around octeon_ep; look for abrupt host reboots or hangs coinciding with device heartbeat loss and module unload events.

What your security team should do

• Prioritize patching all listed Ubuntu kernel packages within the next maintenance window
• Monitor for systems still running pre-fix kernel versions
• Test driver unload and reboot behavior in staging environments after upgrade