CVE-2025-37879

In the Linux kernel, the following vulnerability has been resolved:

9p/net: fix improper handling of bogus negative read/write replies

In p9_client_write() and p9_client_read_once(), if the server incorrectly replies with success but a negative write/read count then we would consider written (negative) <= rsize (positive) because both variables were signed.

Make variables unsigned to avoid this problem.

The reproducer linked below now fails with the following error instead of a null pointer deref: 9pnet: bogus RWRITE count (4294967295 > 3)

This vulnerability is rated as Moderate because exploitation requires an established connection to an untrusted or compromised 9p server, limiting the attack surface to environments actively utilizing the Plan 9 network protocol. In Red Hat Enterprise Linux, 9p protocol support is not loaded by default and is typically confined to virtio-9p host-guest file sharing in virtualized deployments. A malformed server response containing invalid negative transfer counts can trigger a kernel null pointer dereference, resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.