Deadlock Vulnerability in Linux Kernel Hibernate Functionality
Summary
CVE-2025-37745: In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() syzbot reported a deadlock in lock_system_sleep() (see below). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources, including memory, processes, and device drivers. This vulnerability specifically affects the hibernate functionality, which allows systems to save their state and power down, resuming later without data loss. The issue arises during the registration of ieee80211 devices, leading to potential system deadlocks.
Vulnerability Detail
In the Linux kernel, a deadlock occurs in the hibernate_compressor_param_set() function when a write operation to '/sys/module/hibernate/parameters/compressor' conflicts with the registration of ieee80211 devices. This conflict arises when the system_transition_mutex is attempted to be acquired under param_lock, which already holds a lock that depends on the new lock. The deadlock can prevent the system from entering hibernation, leading to potential data loss and system instability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid triggering the deadlock by not modifying the hibernate compressor parameter while ieee80211 devices are being registered. This may involve delaying changes to the hibernate settings until after the device registration process is complete.
Conclusion
The CVE-2025-37745 vulnerability in the Linux kernel poses a significant risk by potentially causing deadlocks during the hibernation process. It is crucial to update to the latest patched version of the kernel to mitigate this risk. Users are also encouraged to utilize tools like Vulert for real-time monitoring of vulnerabilities in their software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37745 is a vulnerability in the Linux kernel that can cause a deadlock during the hibernation process due to conflicting lock acquisitions.
This vulnerability can prevent your system from entering hibernation, potentially leading to data loss and system instability.
Yes, a patch is available in the latest versions of the Linux kernel. It is recommended to update your system to the patched version.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If you cannot update your kernel immediately, avoid modifying the hibernate compressor parameter while ieee80211 devices are being registered as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
