CVE-2025-37812 Details
Description
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix deadlock when using NCM gadget The cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit 58f2fcb3a845 ("usb: cdnsp: Fix deadlock issue during using NCM gadget"). Under PREEMPT_RT the deadlock can be readily triggered by heavy network traffic, for example using "iperf --bidir" over NCM ethernet link. The deadlock occurs because the threaded interrupt handler gets preempted by a softirq, but both are protected by the same spinlock. Prevent deadlock by disabling softirq during threaded irq handler.
A deadlock vulnerability has been identified in the Linux kernel's cdns3 driver when using the NCM gadget. This issue, similar to one previously fixed in the cdnsp driver, can be triggered under PREEMPT_RT by heavy network traffic, such as using iperf with bidirectional mode over an NCM Ethernet link. The deadlock arises because the threaded interrupt handler is preempted by a softirq, with both being protected by the same spinlock. The vulnerability has been resolved by disabling the softirq during the threaded interrupt handler.
The vulnerability has been fixed in the official Linux kernel repository. Users should upgrade to the latest version where this fix is applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/09e90a9689a4aac7a2f726dc2aa472b0b37937b7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/48a62deb857f0694f611949015e70ad194d97159 | kernel.org | Patch |
| https://git.kernel.org/stable/c/59a760e4796a3cd88d8b9d7706e0a638de677751 | kernel.org | Patch |
| https://git.kernel.org/stable/c/74cd6e408a4c010e404832f0e4609d29bf1d0c41 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a1059896f2bfdcebcdc7153c3be2307ea319501f | kernel.org | Patch |
| https://git.kernel.org/stable/c/b96239582531775f2fdcb14de29bdb6870fd4c8c | kernel.org | Patch |
| https://git.kernel.org/stable/c/c27db84ed44e50ff90d9e3a2a25fae2e0a0fa015 | kernel.org | Patch |
| https://git.kernel.org/stable/c/eebfb64c624fc738b669100173344fb441c5e719 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html | CVE | Mailing ListThird Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-667 | Improper Locking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.4, < 5.4.293 >= 5.5, < 5.10.237 >= 5.11, < 5.15.181 >= 5.16, < 6.1.136 >= 6.2, < 6.6.89 >= 6.7, < 6.12.26 >= 6.13, < 6.14.5 6.15 rc1 6.15 rc2 6.15 rc3 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 12, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| May 8, 2025 | New CVE Received | kernel.org |