Kernel Crash Vulnerability in Linux on Qualcomm Chipsets: CVE-2025-37901
Summary
CVE-2025-37901: In the Linux kernel, the following vulnerability has been resolved: irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs On Qualcomm chipsets not all GPIOs are wakeup capable. Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing hardware resources and providing essential services for software applications. It supports a wide range of hardware architectures and is known for its stability and performance. This vulnerability specifically affects the Linux kernel on Qualcomm chipsets, where certain GPIOs (General Purpose Input/Output) are not wakeup capable, leading to potential system crashes when interrupts are incorrectly handled.
Vulnerability Detail
CVE-2025-37901 arises from the mishandling of non-wake GPIOs in the irqchip/qcom-mpm driver. On Qualcomm chipsets, not all GPIOs can trigger wake events, and those without a corresponding MPM pin should not be processed by the MPM driver. The absence of a check for GPIO_NO_WAKE_IRQ in the irq-qcom-mpm driver leads to kernel crashes when attempting to set up interrupts for these GPIOs. This vulnerability can result in system instability and crashes, particularly when using tools like gpiomon to monitor GPIO states.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using non-wake GPIOs for interrupt handling until the kernel is updated. This can prevent crashes related to the vulnerability. Additionally, users can modify their GPIO configurations to ensure that only wake-capable GPIOs are utilized in their applications.
Conclusion
CVE-2025-37901 is a critical vulnerability in the Linux kernel affecting Qualcomm chipsets, leading to potential system crashes due to improper handling of non-wake GPIOs. Users are advised to update their kernel to the latest patched version and avoid using non-wake GPIOs until the update is applied. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37901 is a vulnerability in the Linux kernel affecting Qualcomm chipsets, which can lead to kernel crashes when handling non-wake GPIOs.
If your system uses a Qualcomm chipset and the Linux kernel, it may experience crashes when setting up interrupts for non-wake GPIOs, leading to potential instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
As a workaround, avoid using non-wake GPIOs for interrupt handling until you can apply the necessary updates to your kernel.
Detailed information about CVE-2025-37901 can be found in the official CVE database and security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
