USB Misc Handling Vulnerability in Linux Kernel - CVE-2025-37811
Summary
CVE-2025-37811: In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: ci_hdrc_imx: fix usbmisc handling usbmisc is an optional device property so it is totally valid for the corresponding data->usbmisc_data... Affects linux versions < 6.1.137-1. Fixed in 6.1.137-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware architectures and is known for its stability, performance, and security. The vulnerability CVE-2025-37811 affects the USB Chipidea driver, specifically in the handling of the optional usbmisc device property, which can lead to potential dereferencing of a NULL pointer.
Vulnerability Detail
CVE-2025-37811 is a vulnerability found in the Linux kernel's USB Chipidea driver. The issue arises when the driver attempts to access the usbmisc_data pointer without checking if it is NULL. This oversight can lead to dereferencing a NULL pointer, potentially causing a system crash or unexpected behavior. The vulnerability was identified by the Linux Verification Center using the Svace static analysis tool, emphasizing the importance of proper pointer checks in driver code.
How To Fix
Minimum fixed version
6.1.137-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems and apply the necessary updates as soon as they become available.
Conclusion
CVE-2025-37811 is a significant vulnerability in the Linux kernel's USB Chipidea driver that necessitates immediate attention. Users are encouraged to update their systems to the latest patched versions to prevent potential system instability. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37811 is a vulnerability in the Linux kernel's USB Chipidea driver that can lead to dereferencing a NULL pointer, potentially causing system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and apply updates as soon as possible.
The vulnerability was discovered by the Linux Verification Center using the Svace static analysis tool.
While the vulnerability can lead to system crashes, its criticality depends on the specific use case and environment. It is advisable to apply the patch to ensure system stability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
