CVE-2025-37968

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37968
In the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5 Patch
https://git.kernel.org/stable/c/2c95c8f0959d0a72575eabf2ff888f47ed6d8b77 Patch
https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f Patch
https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7 Patch
https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc Patch
https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9 Patch
https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719 Patch
https://git.kernel.org/stable/c/f063a28002e3350088b4577c5640882bf4ea17ea Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

16 Dec 2025, 20:30

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CWE CWE-667
References () https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5 - () https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5 - Patch
References () https://git.kernel.org/stable/c/2c95c8f0959d0a72575eabf2ff888f47ed6d8b77 - () https://git.kernel.org/stable/c/2c95c8f0959d0a72575eabf2ff888f47ed6d8b77 - Patch
References () https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f - () https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f - Patch
References () https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7 - () https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7 - Patch
References () https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc - () https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc - Patch
References () https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9 - () https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9 - Patch
References () https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719 - () https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719 - Patch
References () https://git.kernel.org/stable/c/f063a28002e3350088b4577c5640882bf4ea17ea - () https://git.kernel.org/stable/c/f063a28002e3350088b4577c5640882bf4ea17ea - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

09 Sep 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5 -
  • () https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f -
  • () https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc -
  • () https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9 -
  • () https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719 -

22 May 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: light: opt3001: corrección de interbloqueo debido al acceso simultáneo a indicadores. La función IRQ enhebrada de este controlador lee el indicador dos veces: una para bloquear un mutex y otra para desbloquearlo. Aunque el código que configura el indicador está diseñado para evitarlo, existen casos sutiles en los que el indicador podría ser verdadero en la etapa mutex_lock y falso en la etapa mutex_unlock. Esto provoca que el mutex no se desbloquee, lo que genera un interbloqueo. Para solucionarlo, haga que el código opt3001_irq() sea generalmente más robusto, leyendo el indicador en una variable y utilizando el valor de la variable en ambas etapas.

20 May 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-20 17:15

Updated : 2025-12-16 20:30

NVD link : CVE-2025-37968

Mitre link : CVE-2025-37968

CVE.ORG link : CVE-2025-37968

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-667

Improper Locking