CVE-2025-37812

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: Fix deadlock when using NCM gadget

The cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit 58f2fcb3a845 ("usb: cdnsp: Fix deadlock issue during using NCM gadget").

Under PREEMPT_RT the deadlock can be readily triggered by heavy network traffic, for example using "iperf --bidir" over NCM ethernet link.

The deadlock occurs because the threaded interrupt handler gets preempted by a softirq, but both are protected by the same spinlock. Prevent deadlock by disabling softirq during threaded irq handler.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-667

Affected software

VendorProductVersions
LinuxLinux>= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < eebfb64c624fc738b669100173344fb441c5e719; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < 59a760e4796a3cd88d8b9d7706e0a638de677751; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < b96239582531775f2fdcb14de29bdb6870fd4c8c; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < c27db84ed44e50ff90d9e3a2a25fae2e0a0fa015; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < 48a62deb857f0694f611949015e70ad194d97159; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < 74cd6e408a4c010e404832f0e4609d29bf1d0c41; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < 09e90a9689a4aac7a2f726dc2aa472b0b37937b7; >= 7733f6c32e36ff9d7adadf40001039bf219b1cbe, < a1059896f2bfdcebcdc7153c3be2307ea319501f
LinuxLinux5.4

References

Timeline

Published
May 8, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-378135.5In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix invalid pointer dereference in Etron workaround This chCVE-2025-378145.5In the Linux kernel, the following vulnerability has been resolved: tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT ThisCVE-2025-378155.5In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registraCVE-2025-378165.5In the Linux kernel, the following vulnerability has been resolved: mei: vsc: Fix fortify-panic caused by invalid counted_by() use gcc 15 CVE-2025-378177.8In the Linux kernel, the following vulnerability has been resolved: mcb: fix a double free bug in chameleon_parse_gdd() In chameleon_parseCVE-2025-378185.5In the Linux kernel, the following vulnerability has been resolved: LoongArch: Return NULL from huge_pte_offset() for invalid PMD LoongArcCVE-2025-378197.8In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACCVE-2025-37826.4The Cision Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and includiCVE-2025-378205.5In the Linux kernel, the following vulnerability has been resolved: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() The CVE-2025-378215.5In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash ThCVE-2025-378227.8In the Linux kernel, the following vulnerability has been resolved: riscv: uprobes: Add missing fence.i after building the XOL buffer The CVE-2025-378237.8In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly t
CVE-2025-37812: Medium severity, CVSS 5.5 | Vulnix