Kernel NULL Pointer Dereference Vulnerability in Linux Packages
Summary
CVE-2025-37801: In the Linux kernel, the following vulnerability has been resolved: spi: spi-imx: Add check for spi_imx_setupxfer() Add check for the return value of spi_imx_setupxfer(). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various environments, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes or unauthorized access. This specific vulnerability affects the SPI (Serial Peripheral Interface) subsystem, which is crucial for communication between the CPU and peripheral devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SPI subsystem, specifically within the spi-imx driver. The issue arises from a lack of error handling in the spi_imx_setupxfer() function. When this function encounters an error, it can result in the function pointers spi_imx->rx and spi_imx->tx being set to NULL. This leads to a potential NULL pointer dereference, causing the kernel to crash and resulting in a denial of service. The vulnerability is critical as it can be exploited to disrupt system operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the necessary updates as soon as they are available.
Conclusion
The CVE-2025-37801 vulnerability in the Linux kernel's SPI subsystem poses a significant risk due to potential NULL pointer dereference, leading to system crashes. Users are strongly encouraged to update their Linux packages to the latest versions to ensure system security and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37801 is a vulnerability in the Linux kernel's SPI subsystem that can lead to a NULL pointer dereference, causing system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to system instability, crashes, and denial of service, affecting the overall performance of the system.
Yes, patches are available in the latest versions of the Linux kernel. Users are advised to update their systems to the patched versions.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
