CVE-2025-37907 accel/ivpu: Fix locking order in ivpu_job_submit
A locking order error in the Linux kernel's Intel VPU driver causes a deadlock during job submission and abort handling, leading to system denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37907?
CVE-2025-37907 is a medium-severity vulnerability in Linux kernel, published on 20 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix locking order in ivpu_job_submit
Fix deadlock in job submission and abort handling. When a thread aborts currently executing jobs due to a fault, it first locks the global lock protecting submitted_jobs (#1).
After the last job is destroyed, it proceeds to release the related context and locks file_priv (#2). Meanwhile, in the job submission thread, the file_priv lock (#2) is taken first, and then the submitted_jobs lock (#1) is obtained when a job is added to the submitted jobs list.
CPU0 CPU1 ---- ---- (for example due to a fault) (jobs submissions keep coming)
lock(&vdev->submitted_jobs_lock) #1 ivpu_jobs_abort_all() job_destroy() lock(&file_priv->lock) #2 lock(&vdev->submitted_jobs_lock) #1 file_priv_release() lock(&vdev->context_list_lock) lock(&file_priv->lock) #2
This order of locking causes a deadlock. To resolve this issue, change the order of locking in ivpu_job_submit().
Weakness: CWE-667
Which versions are affected by CVE-2025-37907?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-37907?
Apply the vendor's patch.
Is CVE-2025-37907 being exploited?
There is no known exploitation of CVE-2025-37907 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-62821, BELL-CVE-2025-37907, DEBIAN-CVE-2025-37907, GHSA-73j2-7869-745f, ROOT-OS-UBUNTU-2204-CVE-2025-37907, ROOT-OS-UBUNTU-2404-CVE-2025-37907 and 1 more.