Cache Coherency Issue in Linux Kernel - CVE-2025-37977
Summary
CVE-2025-37977: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set If dma-coherent property isn't set then descriptors are non-cacheable and the iocc sh... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages system resources and hardware interactions, providing essential services to applications. The kernel is critical for system stability and performance. This vulnerability specifically affects the UFS (Universal Flash Storage) driver in the Linux kernel, which is responsible for managing UFS devices. The issue arises when the dma-coherent property is not set, leading to potential cache-related stability problems.
Vulnerability Detail
CVE-2025-37977 is a vulnerability in the Linux kernel's UFS driver, where the absence of the dma-coherent property results in non-cacheable descriptors. This misconfiguration can lead to random stability issues due to incompatible cache settings. If left unaddressed, it may cause system crashes or unpredictable behavior, particularly in environments relying on UFS devices.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, ensuring that the dma-coherent property is correctly set in your system configuration may help mitigate potential issues until the package is updated.
Conclusion
CVE-2025-37977 presents a significant risk to systems using the Linux kernel's UFS driver without the proper dma-coherent property. It is crucial to update to the patched version to ensure system stability and prevent potential crashes. Regular monitoring of vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37977 is a vulnerability in the Linux kernel's UFS driver that can lead to cache-related stability issues.
If your system uses UFS devices without the correct dma-coherent property set, it may experience random crashes or instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without needing to access the code directly.
Yes, a patched version of the Linux package is available for Debian 13 (version 6.12.27-1).
While there are no specific workarounds, ensure that your system configuration is correct and monitor for updates regularly.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
