CVE-2025-37842 spi: fsl-qspi: use devm function instead of driver remove
A kernel panic occurs during device detach in the fsl-qspi driver due to incorrect resource cleanup order, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37842?
CVE-2025-37842 is a medium-severity vulnerability in Linux kernel, published on 9 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
spi: fsl-qspi: use devm function instead of driver remove
Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kernel panic. Drop the remove function and use devm_add_action_or_reset() for driver cleanup to ensure the release sequence.
Trigger kernel panic on i.MX8MQ by echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind
Which versions are affected by CVE-2025-37842?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-37842?
Apply the vendor's patch.
Is CVE-2025-37842 being exploited?
There is no known exploitation of CVE-2025-37842 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-62495, AZL-70364, BELL-CVE-2025-37842, DEBIAN-CVE-2025-37842, GHSA-3hq4-hxjg-vwx8, ROOT-OS-DEBIAN-11-CVE-2025-37842 and 4 more.