Critical Spinlock Recursion Vulnerability in Linux Kernel (CVE-2025-37917)
Summary
CVE-2025-37917: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll Use spin_lock_irqsave and spin_unlock_irqrestore instead of spin_lock and spin... Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is widely used in various environments, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes or unauthorized access. This specific vulnerability affects the mtk_star_emac driver, which is responsible for handling Ethernet communications on MediaTek devices.
Vulnerability Detail
CVE-2025-37917 is a critical vulnerability that arises from improper handling of spinlocks in the mtk_star_emac driver. The issue occurs when enabling DMA interrupts during receive/transmit polling, leading to potential spinlock recursion. This can cause system instability, crashes, or unexpected behavior, as indicated by the error message: 'BUG: spinlock recursion on CPU#0'. The vulnerability can be exploited in environments where the driver is used, particularly on MediaTek hardware.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable DMA interrupts in the mtk_star_emac driver configuration. However, this may impact network performance. To disable DMA interrupts, modify the driver settings in the kernel configuration or use the following command:
echo 0 > /sys/module/mtk_star_emac/parameters/dma_interrupts_enabled
Please note that this is not a permanent solution and should only be used until the kernel is updated.
Conclusion
CVE-2025-37917 is a significant vulnerability in the Linux kernel that affects the mtk_star_emac driver. Users are advised to update their systems promptly to mitigate the risks associated with this issue. Utilizing tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37917 is a vulnerability in the Linux kernel related to spinlock recursion in the mtk_star_emac driver, which can lead to system instability.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to system crashes, instability, and potential unauthorized access to system resources.
Yes, a patch has been released. Users should update their Linux kernel to the latest version to apply the fix.
Regularly update your software and dependencies, and utilize tools like Vulert to monitor for vulnerabilities in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
