Critical Isochronous Ring Underrun/Overrun Handling Vulnerability in Linux Kernel
Summary
CVE-2025-37882: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHC... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness, flexibility, and extensive support for various hardware architectures. However, vulnerabilities can arise, impacting system stability and security. The specific issue at hand involves the handling of isochronous Ring Underrun/Overrun events in the xHCI (eXtensible Host Controller Interface) subsystem, which can lead to data loss or buffer use-after-free (UAF) conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2025-37882, originates from improper handling of TRB (Transfer Request Block) pointers during isochronous event processing in xHCI 1.1+ host controllers. When a missed service error occurs, the system may skip processing certain transfer descriptors (TDs) and prematurely process new TDs, risking data loss or UAF. This race condition can be triggered by increasing interrupt moderation or due to natural system load, leading to potential instability and security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users can mitigate risks by monitoring system load and interrupt moderation settings to avoid triggering the race condition.
Conclusion
CVE-2025-37882 is a critical vulnerability in the Linux kernel affecting isochronous event handling in xHCI host controllers. Users are strongly encouraged to update their systems to the latest patched versions to mitigate potential risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring code access.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37882 is a vulnerability in the Linux kernel related to improper handling of isochronous Ring Underrun/Overrun events in xHCI host controllers.
The vulnerability can lead to data loss or buffer use-after-free conditions, which may compromise system stability and security.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Yes, users are advised to update their Linux kernel to the latest patched version available for their distribution to mitigate this vulnerability.
While there are no specific workarounds, you can monitor system load and adjust interrupt moderation settings to reduce the risk of triggering the race condition.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
