CVE-2025-37984

What it actually does

Potential integer overflow in DIV_ROUND_UP() when ecdsa key_size() returns large values, leading to incorrect calculations in memory sizing for ECC operations and possible buffer mishandling in the Linux kernel crypto subsystem.

Why it matters to the business

On Linux systems using ECDSA crypto, this could enable memory corruption that disrupts kernel operations or allows privilege escalation, though the specific trigger conditions limit widespread impact; organizations running older kernels face elevated risk of stability issues or targeted attacks.

How an attack unfolds

An attacker supplies input that causes an ecdsa implementation's key_size() to return an oversized value or manipulates ASN.1 lengths passed to ecc_digits_from_bytes(), triggering the unsafe DIV_ROUND_UP() macro to produce an overflowed result that corrupts memory allocations during signature handling.

How to fix it

Upgrade the Linux kernel to version 6.6.99 or later, or apply commit f02f0218be412cff1c844addf58e002071be298b which replaces DIV_ROUND_UP with the hardened DIV_ROUND_UP_POW2 macro for key_size values.

How to confirm the fix worked

Confirm the running kernel version meets or exceeds 6.6.99, inspect crypto/ecdsa source for the new DIV_ROUND_UP_POW2 macro usage, and test ECDSA operations with boundary key sizes to verify correct behavior.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions with ECDSA crypto enabled
2. Craft malicious key material or ASN.1 structures to force oversized key_size return values
3. Trigger the DIV_ROUND_UP overflow to induce memory corruption
4. Leverage the corruption for kernel-level code execution or denial of service

How to detect it

Review kernel logs and audit trails for ECDSA-related crashes or unusual signature processing errors; correlate with process activity involving crypto subsystems on systems that have not yet been patched.

What your security team should do

• Prioritize kernel upgrades on all production systems within the next maintenance window
• Audit workloads relying on ECDSA in the kernel for exposure and consider disabling if unnecessary
• Monitor kernel logs for related crypto errors or crashes as an interim detection measure