CVE-2025-37975

What it actually does

Out-of-bounds read in RISC-V module relocation handler allows rel[j] to index one element past the end of the relocation section during module loading.

Why it matters to the business

Local attackers on RISC-V Linux systems can trigger kernel memory corruption leading to crashes, denial of service, or potential privilege escalation; affected kernels must be updated promptly to avoid operational disruption.

How an attack unfolds

An attacker compiles or crafts a malicious kernel module whose relocation table is sized such that the off-by-one access reads adjacent kernel memory; when the module is loaded the kernel dereferences the out-of-bounds entry, enabling memory disclosure or corruption that can be leveraged for further exploitation.

How to fix it

Upgrade the Linux kernel to commit a068ea00009d373d825c528f9c168501519211b4 or later; for Ubuntu 22.04 LTS install openrefine 3.5.2-1ubuntu0.1~esm1 or newer; for Ubuntu 24.04 LTS install openrefine 3.7.7-1ubuntu0.1~esm1 or newer; rebuild and reboot all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit a068ea00009d373d825c528f9c168501519211b4; confirm package versions match the listed fixed releases; attempt to load a module with a relocation table sized to the boundary condition and observe absence of the prior crash or warning.

Typical attack path

1. Obtain local access on a RISC-V system running an affected kernel
2. Prepare a kernel module whose .rel or .rela section has a relocation count that triggers the off-by-one indexing
3. Load the module via insmod or modprobe
4. Kernel relocation processing performs the out-of-bounds access
5. Attacker uses resulting memory corruption to escalate privileges or crash the system

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for relocation-related warnings or oops during module loads; correlate module load events with crashes on RISC-V systems; inspect audit logs for unusual insmod activity preceding kernel panics.

What your security team should do

• Prioritize patching all RISC-V production kernels within the next maintenance window
• Add the fixed commit hash to automated kernel build pipelines
• Scan package repositories for any remaining vulnerable openrefine or linux-image packages and replace them
• Update detection rules to watch for unexpected module load failures on RISC-V hosts