cve 2025 37857

CVE-2025-37857 is a Linux kernel vulnerability in the SCSI tape driver (st) that causes an array overflow in the st_setup() function. The fix sizes a local buffer based on the incoming parms length instead of a hardcoded value. Microsoft's advisory states that Azure Linux includes the affected open-source component and is potentially affected. This tag covers discussions about the vulnerability details, the upstream patch, and Microsoft's product-level attestation regarding Azure Linux. It is relevant for IT professionals and system administrators managing Linux systems, particularly those using Azure Linux, who need to understand the risk and apply the necessary kernel updates.