CVE-2025-37968

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37968

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.

References
Link Resource
https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5 Patch
https://git.kernel.org/stable/c/2c95c8f0959d0a72575eabf2ff888f47ed6d8b77 Patch
https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f Patch
https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7 Patch
https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc Patch
https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9 Patch
https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719 Patch
https://git.kernel.org/stable/c/f063a28002e3350088b4577c5640882bf4ea17ea Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

16 Dec 2025, 20:30

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-667
First Time Linux linux Kernel
Debian
Linux
Debian debian Linux
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5 - () https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5 - Patch
References () https://git.kernel.org/stable/c/2c95c8f0959d0a72575eabf2ff888f47ed6d8b77 - () https://git.kernel.org/stable/c/2c95c8f0959d0a72575eabf2ff888f47ed6d8b77 - Patch
References () https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f - () https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f - Patch
References () https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7 - () https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7 - Patch
References () https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc - () https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc - Patch
References () https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9 - () https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9 - Patch
References () https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719 - () https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719 - Patch
References () https://git.kernel.org/stable/c/f063a28002e3350088b4577c5640882bf4ea17ea - () https://git.kernel.org/stable/c/f063a28002e3350088b4577c5640882bf4ea17ea - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

09 Sep 2025, 17:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/1d7def97e7eb65865ccc01bbdf4eb9e6bbe8a5b5 -
  • () https://git.kernel.org/stable/c/748ebd8e61d0bc182c331b8df3887af7285c8a8f -
  • () https://git.kernel.org/stable/c/957e8be112636d9bc692917286e81e54bd87decc -
  • () https://git.kernel.org/stable/c/a9c56ccb7cddfca754291fb24b108a5350a5fbe9 -
  • () https://git.kernel.org/stable/c/e791bf216c9e236b34dabf514ec0ede140cca719 -

22 May 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/7ca84f6a22d50bf8b31efe9eb05f9859947266d7 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: light: opt3001: corrección de interbloqueo debido al acceso simultáneo a indicadores. La función IRQ enhebrada de este controlador lee el indicador dos veces: una para bloquear un mutex y otra para desbloquearlo. Aunque el código que configura el indicador está diseñado para evitarlo, existen casos sutiles en los que el indicador podría ser verdadero en la etapa mutex_lock y falso en la etapa mutex_unlock. Esto provoca que el mutex no se desbloquee, lo que genera un interbloqueo. Para solucionarlo, haga que el código opt3001_irq() sea generalmente más robusto, leyendo el indicador en una variable y utilizando el valor de la variable en ambas etapas.

20 May 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-20 17:15

Updated : 2025-12-16 20:30

NVD link : CVE-2025-37968

Mitre link : CVE-2025-37968

CVE.ORG link : CVE-2025-37968

JSON object : View

Products Affected

linux

debian

CWE
CWE-667

Improper Locking