CVE-2025-37949

What it actually does

Use-after-free in xenbus request handling allows a freed request structure to be dereferenced during wake-up in xenbus_thread after xs_wait_for_reply completes, resulting in NULL pointer dereference.

Why it matters to the business

Systems running the affected Ubuntu kernel on AWS may experience crashes or local privilege escalation; the vulnerability affects cloud workloads using Xen-based virtualization and has moderate ecosystem prevalence in long-term support distributions.

How an attack unfolds

An attacker with local access triggers concurrent xenbus message processing that races between callback execution and request freeing; the freed request is later accessed by xenbus_thread causing a crash or potential control-flow hijack, consistent with patterns seen in related Linux kernel privilege-escalation campaigns.

How to fix it

Upgrade linux-aws-5.15 packages to version 5.15.0-1073.79~20.04.1 or later; apply the kref-based lifetime tracking fix for xenbus requests; reboot after installation.

How to confirm the fix worked

Confirm package version is at or above the fixed release using apt or dpkg; verify xenbus code contains the kref_get and kref_put calls described in the patch; run kernel regression tests exercising xenbus message paths.

Typical attack path

1. Obtain local unprivileged access on an affected Ubuntu 20.04 AWS instance
2. Craft or trigger xenbus device or message operations that exercise process_msg and xs_wake_up paths
3. Exploit the race condition between kfree of the request and subsequent __wake_up_common dereference
4. Achieve kernel crash for denial of service or escalate privileges via memory corruption

How to detect it

Review kernel logs for BUG: kernel NULL pointer dereference in __wake_up_common or xenbus_thread call stacks; correlate with process activity involving xenbus devices; look for unexpected privilege-escalation attempts in audit logs on systems running the affected kernel versions.

What your security team should do

• Prioritize patching all linux-aws-5.15 instances on Ubuntu 20.04 within standard maintenance windows given the privilege-escalation context of related kernel CVEs
• Monitor for kernel oops or NULL dereference logs in xenbus_thread
• Restrict local access on multi-tenant Xen environments until patches are deployed