Critical Assertion Bug in Linux Kernel's plfxlc Module
Summary
CVE-2025-37897: In the Linux kernel, the following vulnerability has been resolved: wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release plfxlc_mac_release() asserts that mac->lock is held. Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. The plfxlc module is a driver for PureLiFi devices, enabling wireless communication through light. This module is crucial for the functionality of devices that rely on light-based communication, but it has a vulnerability that can lead to system warnings and potential instability.
Vulnerability Detail
The vulnerability, identified as CVE-2025-37897, arises from an erroneous assertion in the plfxlc_mac_release function within the plfxlc module. The function incorrectly asserts that the mac->lock is held, which is not valid behavior during probe failures or device disconnections. This can lead to warnings during operation, indicating that the driver is not managing device states correctly, potentially resulting in system instability or crashes.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to avoid any potential issues.
Conclusion
CVE-2025-37897 is a critical vulnerability in the Linux kernel's plfxlc module that can lead to system warnings and instability. Users are advised to update their systems to the latest patched version to mitigate this issue. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37897 is a vulnerability in the Linux kernel's plfxlc module that arises from an incorrect assertion in the plfxlc_mac_release function.
The vulnerability affects Debian versions 12 and 13 of the Linux kernel that include the plfxlc module.
The vulnerability can lead to system warnings and may cause instability or crashes in systems using the affected module.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available in the latest versions of the Linux kernel. Users should update their systems to the latest patched version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.