CVE-2025-37842

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37842
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kernel panic. Drop the remove function and use devm_add_action_or_reset() for driver cleanup to ensure the release sequence. Trigger kernel panic on i.MX8MQ by echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/40369bfe717e96e26650eeecfa5a6363563df6e4 Patch
https://git.kernel.org/stable/c/439688dbe82baa10d4430dc3252bb5ef1183a171 Patch
https://git.kernel.org/stable/c/50ae352c1848cab408fb4f7d7f50c71f818bbdbf Patch
https://git.kernel.org/stable/c/f68b27d82a749117d9c7d7f33fa53f46373e38e2 Patch
https://git.kernel.org/stable/c/f9bfb3a5f6f616f3eb7665c8ff3bcb9760ae33c8 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Nov 2025, 12:49

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/40369bfe717e96e26650eeecfa5a6363563df6e4 - () https://git.kernel.org/stable/c/40369bfe717e96e26650eeecfa5a6363563df6e4 - Patch
References () https://git.kernel.org/stable/c/439688dbe82baa10d4430dc3252bb5ef1183a171 - () https://git.kernel.org/stable/c/439688dbe82baa10d4430dc3252bb5ef1183a171 - Patch
References () https://git.kernel.org/stable/c/50ae352c1848cab408fb4f7d7f50c71f818bbdbf - () https://git.kernel.org/stable/c/50ae352c1848cab408fb4f7d7f50c71f818bbdbf - Patch
References () https://git.kernel.org/stable/c/f68b27d82a749117d9c7d7f33fa53f46373e38e2 - () https://git.kernel.org/stable/c/f68b27d82a749117d9c7d7f33fa53f46373e38e2 - Patch
References () https://git.kernel.org/stable/c/f9bfb3a5f6f616f3eb7665c8ff3bcb9760ae33c8 - () https://git.kernel.org/stable/c/f9bfb3a5f6f616f3eb7665c8ff3bcb9760ae33c8 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo

09 Sep 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/50ae352c1848cab408fb4f7d7f50c71f818bbdbf -

06 Jul 2025, 10:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/f68b27d82a749117d9c7d7f33fa53f46373e38e2 -

12 May 2025, 17:32

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: fsl-qspi: usar la función devm en lugar de eliminar el controlador. El controlador usa las API devm para administrar clk/irq/resources y registrar el controlador spi, pero la función de eliminación heredada se llamará primero durante la desconexión del dispositivo y activará el pánico del kernel. Se debe omitir la función de eliminación y usar devm_add_action_or_reset() para limpiar el controlador y asegurar la secuencia de liberación. Se activa el pánico del kernel en i.MX8MQ mediante echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind.

09 May 2025, 07:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-09 07:16

Updated : 2025-11-17 12:49

NVD link : CVE-2025-37842

Mitre link : CVE-2025-37842

CVE.ORG link : CVE-2025-37842

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo