CVE-2026-37525 Linuxfoundation CVE debrief

Who should care

Automotive Linux/AGL maintainers, afb-daemon integrators, and teams that own APIs invoked through the supervision path should prioritize this issue. Security teams should also review any application logic that assumes NULL credentials are equivalent to authenticated or authorized access.

Technical summary

The CVE description states that on_supervision_call in src/afb-supervision.c explicitly calls afb_context_change_cred(&xreq->context, NULL) before invoking xapi->itf->call(xapi->closure, xreq). The metadata also describes the propagation chain through afb-context.c and afb-cred.c that preserves the NULL credential state. Because the api and verb parameters are attacker-controlled via JSON input, the caller can trigger execution of a chosen registered API under a NULL credential context. NVD classifies the issue as CWE-269 and records CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

High for any deployment that exposes or relies on the supervision Do command. The issue requires local/privileged access according to NVD, but the impact can be severe if privileged APIs fail open when credentials are NULL.

Recommended defensive actions

• Review and patch on_supervision_call so credentials are not cleared before dispatch, or so authorization is enforced explicitly before any API call is made.
• Audit all APIs reachable from afb-daemon for NULL-credential handling and treat NULL as unauthorized by default unless a specific design requires otherwise.
• Restrict access to the supervision Do command and any JSON paths that select api and verb values.
• Validate the vendor's fixed versions or advisory guidance for AGL app-framework-binder and confirm your deployed release is not in the affected range.
• Add logging and alerting for supervision calls that execute with NULL credentials or that invoke privileged APIs without an authenticated context.

Evidence notes

This debrief is based on the CVE description and NVD metadata supplied in the corpus. The NVD record says the vulnerability is analyzed, assigns CWE-269, and lists CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The source metadata also includes a broken Gerrit reference and a third-party gist reference; those were not needed as primary evidence. The corpus contains version-context differences: the textual description says the issue exists through v19.90.0, while the NVD CPE criteria marks linuxfoundation:automotive_grade_linux as vulnerable up to 17.1.12. Consumers should verify exact affected versions against upstream release and patch information.

Official resources