The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.
Conclusion & alert: CVE-2014-1737 is rated Moderate Risk (42.6/100): CVSS High severity, with low exploitation likelihood (EPSS 0.49%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.04% | 0.49% | +0.44% |
| 2 | 2025-10-17 | 0.07% | 0.04% | -0.03% |
| 3 | 2025-05-27 | — | 0.07% | — |
Full EPSS history (7 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.2 | 2.0 | HIGH |
|
3.9 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2014-1737 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2014-1737 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2014-1737 |
ubuntu
|
high | CVE-2014-1737 high priority: Ubuntu including 30 source packages (linux, linux-armadaxp, …), 315 status rows across 12 suites (lucid, precise, quantal, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): DNE 218, released 42, not-affected 35, ignored 20. | https://ubuntu.com/security/CVE-2014-1737 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| linux | linux_kernel | < 3.2.59 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 3.3, < 3.4.90 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 3.5, < 3.10.40 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 3.11, < 3.12.20 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 3.13, < 3.14.4 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| oracle | linux | 5 | cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:* |
| oracle | linux | 6 | cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:* |
| debian | debian_linux | 6.0 | cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
| debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| suse | linux_enterprise_desktop | 11 | cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:* |
| suse | linux_enterprise_high_availability_extension | 11 | cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:* |
| suse | linux_enterprise_real_time_extension | 11 | cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp3:*:*:*:*:*:* |
| suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:* |
| suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:* |
| redhat | enterprise_linux_eus | 5.6 | cpe:2.3:o:redhat:enterprise_linux_eus:5.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 6.3 | cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:* |