CVE-2025-37812 usb: cdns3: Fix deadlock when using NCM gadget
A race condition in the Linux kernel cdns3 USB driver causes a deadlock under heavy network traffic, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37812?
CVE-2025-37812 is a medium-severity vulnerability in Debian Debian Linux, published on 8 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: Fix deadlock when using NCM gadget
The cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit 58f2fcb3a845 ("usb: cdnsp: Fix deadlock issue during using NCM gadget").
Under PREEMPT_RT the deadlock can be readily triggered by heavy network traffic, for example using "iperf --bidir" over NCM ethernet link.
The deadlock occurs because the threaded interrupt handler gets preempted by a softirq, but both are protected by the same spinlock. Prevent deadlock by disabling softirq during threaded irq handler.
Weakness: CWE-667
Which versions are affected by CVE-2025-37812?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-37812?
Apply the vendor's patch.
Is CVE-2025-37812 being exploited?
There is no known exploitation of CVE-2025-37812 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-37812, DEBIAN-CVE-2025-37812, GHSA-v2qv-w894-wvxx, ROOT-OS-DEBIAN-12-CVE-2025-37812, ROOT-OS-UBUNTU-2204-CVE-2025-37812, ROOT-OS-UBUNTU-2404-CVE-2025-37812 and 1 more.