CVE-2025-37813

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37813", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.946Z", "datePublished": "2025-05-08T06:26:10.000Z", "dateUpdated": "2026-10-15T21:52:00.500Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:42.473Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix invalid pointer dereference in Etron workaround\n\nThis check is performed before prepare_transfer() and prepare_ring(), so\nenqueue can already point at the final link TRB of a segment. And indeed\nit will, some 0.4% of times this code is called.\n\nThen enqueue + 1 is an invalid pointer. It will crash the kernel right\naway or load some junk which may look like a link TRB and cause the real\nlink TRB to be replaced with a NOOP. This wouldn't end well.\n\nUse a functionally equivalent test which doesn't dereference the pointer\nand always gives correct result.\n\nSomething has crashed my machine twice in recent days while playing with\nan Etron HC, and a control transfer stress test ran for confirmation has\njust crashed it again. The same test passes with this patch applied."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is entered whenever a control transfer is queued on a SuperSpeed device's ep0, which an unprivileged local process can drive directly via usbfs ioctls (USBDEVFS_CONTROL/USBDEVFS_SUBMITURB), hidraw feature reports, or ALSA/UVC control APIs on an already-attached device. No network or physical access is needed once any USB3 device is present on the Etron host.\nAC:L - Within the affected configuration the attacker fully controls the trigger \u2014 the enqueue pointer lands on the segment's final Link TRB on roughly 0.4% of calls, so a short loop of control transfers hits it deterministically in well under a second, exactly as the author's stress test demonstrated. No memory layout or timing condition outside the attacker's influence is required.\nPR:L - A basic unprivileged local account suffices, since desktop/kiosk systems grant the seat's logged-in user access to USB device nodes (usbfs, hidraw, ALSA controls) through udev uaccess rules, and any of those interfaces emit ep0 control transfers. No CAP_SYS_ADMIN or root is required to reach xhci_queue_ctrl_tx().\nUI:N - The attacker issues the control transfers from their own process; no victim action, no mount, and no file-open by another user is involved. Enumeration-driven variants are likewise self-initiated.\nS:U - The out-of-bounds read and the subsequent ring corruption both occur within kernel memory managed by the same security authority; the impact does not cross a VM, IOMMU, or sandbox boundary in the CVSS sense.\nC:H - The out-of-bounds read pulls in contents of an unrelated page adjacent to the DMA segment, and the resulting Link-TRB destruction makes the host controller execute arbitrary post-segment memory as TRBs whose 64-bit buffer pointers can source DMA reads from arbitrary kernel memory, with the data delivered back to userspace through URB completion.\nI:H - The driver overwrites the live Link TRB with a No-Op, corrupting the transfer ring, after which the xHC fetches junk TRBs from outside the ring and can perform DMA writes of device-supplied data to attacker-influenceable addresses \u2014 an arbitrary kernel memory write primitive suitable for control-flow hijacking.\nA:H - The commit states the invalid dereference \"will crash the kernel right away\" on the OOB access; failing that, the corrupted ring wedges the endpoint permanently (\"Tried to move enqueue past ring segment\") and drives the controller off the end of the segment, and the author reproduced machine crashes three times."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/host/xhci-ring.c"], "versions": [{"version": "fbc0a0c7718a6cb1dc5e0811a4f88a2b1deedfa1", "lessThan": "142273a49f2c315eabdbdf5a71c15e479b75ca91", "status": "affected", "versionType": "git"}, {"version": "9258c9ed32294ce3a4b58c9d92fc49ba030d35c9", "lessThan": "bce3055b08e303e28a8751f6073066f5c33a0744", "status": "affected", "versionType": "git"}, {"version": "5e1c67abc9301d05130b7e267c204e7005503b33", "lessThan": "0624e29c595b05e7a0e6d1c368f0a05799928e30", "status": "affected", "versionType": "git"}, {"version": "5e1c67abc9301d05130b7e267c204e7005503b33", "lessThan": "1ea050da5562af9b930d17cbbe9632d30f5df43a", "status": "affected", "versionType": "git"}, {"version": "4725344ca645a98a9d8e45e25b01a2244de5b8aa", "status": "affected", "versionType": "git"}, {"version": "6.6.66", "lessThan": "6.6.89", "status": "affected", "versionType": "semver"}, {"version": "6.12.2", "lessThan": "6.12.26", "status": "affected", "versionType": "semver"}, {"version": "6.11.11", "lessThan": "6.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/host/xhci-ring.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.89", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.5", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.66", "versionEndExcluding": "6.6.89"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.2", "versionEndExcluding": "6.12.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.14.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91"}, {"url": "https://git.kernel.org/stable/c/bce3055b08e303e28a8751f6073066f5c33a0744"}, {"url": "https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30"}, {"url": "https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a"}], "title": "usb: xhci: Fix invalid pointer dereference in Etron workaround", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37813", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:20.958093Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:00.500Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37813", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:20.958093Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:45:21.719Z"}}], "cna": {"title": "usb: xhci: Fix invalid pointer dereference in Etron workaround", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is entered whenever a control transfer is queued on a SuperSpeed device's ep0, which an unprivileged local process can drive directly via usbfs ioctls (USBDEVFS_CONTROL/USBDEVFS_SUBMITURB), hidraw feature reports, or ALSA/UVC control APIs on an already-attached device. No network or physical access is needed once any USB3 device is present on the Etron host.\nAC:L - Within the affected configuration the attacker fully controls the trigger \u2014 the enqueue pointer lands on the segment's final Link TRB on roughly 0.4% of calls, so a short loop of control transfers hits it deterministically in well under a second, exactly as the author's stress test demonstrated. No memory layout or timing condition outside the attacker's influence is required.\nPR:L - A basic unprivileged local account suffices, since desktop/kiosk systems grant the seat's logged-in user access to USB device nodes (usbfs, hidraw, ALSA controls) through udev uaccess rules, and any of those interfaces emit ep0 control transfers. No CAP_SYS_ADMIN or root is required to reach xhci_queue_ctrl_tx().\nUI:N - The attacker issues the control transfers from their own process; no victim action, no mount, and no file-open by another user is involved. Enumeration-driven variants are likewise self-initiated.\nS:U - The out-of-bounds read and the subsequent ring corruption both occur within kernel memory managed by the same security authority; the impact does not cross a VM, IOMMU, or sandbox boundary in the CVSS sense.\nC:H - The out-of-bounds read pulls in contents of an unrelated page adjacent to the DMA segment, and the resulting Link-TRB destruction makes the host controller execute arbitrary post-segment memory as TRBs whose 64-bit buffer pointers can source DMA reads from arbitrary kernel memory, with the data delivered back to userspace through URB completion.\nI:H - The driver overwrites the live Link TRB with a No-Op, corrupting the transfer ring, after which the xHC fetches junk TRBs from outside the ring and can perform DMA writes of device-supplied data to attacker-influenceable addresses \u2014 an arbitrary kernel memory write primitive suitable for control-flow hijacking.\nA:H - The commit states the invalid dereference \"will crash the kernel right away\" on the OOB access; failing that, the corrupted ring wedges the endpoint permanently (\"Tried to move enqueue past ring segment\") and drives the controller off the end of the segment, and the author reproduced machine crashes three times."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fbc0a0c7718a6cb1dc5e0811a4f88a2b1deedfa1", "lessThan": "142273a49f2c315eabdbdf5a71c15e479b75ca91", "versionType": "git"}, {"status": "affected", "version": "9258c9ed32294ce3a4b58c9d92fc49ba030d35c9", "lessThan": "bce3055b08e303e28a8751f6073066f5c33a0744", "versionType": "git"}, {"status": "affected", "version": "5e1c67abc9301d05130b7e267c204e7005503b33", "lessThan": "0624e29c595b05e7a0e6d1c368f0a05799928e30", "versionType": "git"}, {"status": "affected", "version": "5e1c67abc9301d05130b7e267c204e7005503b33", "lessThan": "1ea050da5562af9b930d17cbbe9632d30f5df43a", "versionType": "git"}, {"status": "affected", "version": "4725344ca645a98a9d8e45e25b01a2244de5b8aa", "versionType": "git"}, {"status": "affected", "version": "6.6.66", "lessThan": "6.6.89", "versionType": "semver"}, {"status": "affected", "version": "6.12.2", "lessThan": "6.12.26", "versionType": "semver"}, {"status": "affected", "version": "6.11.11", "lessThan": "6.12", "versionType": "semver"}], "programFiles": ["drivers/usb/host/xhci-ring.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.89", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.26", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.5", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/host/xhci-ring.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91"}, {"url": "https://git.kernel.org/stable/c/bce3055b08e303e28a8751f6073066f5c33a0744"}, {"url": "https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30"}, {"url": "https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix invalid pointer dereference in Etron workaround\n\nThis check is performed before prepare_transfer() and prepare_ring(), so\nenqueue can already point at the final link TRB of a segment. And indeed\nit will, some 0.4% of times this code is called.\n\nThen enqueue + 1 is an invalid pointer. It will crash the kernel right\naway or load some junk which may look like a link TRB and cause the real\nlink TRB to be replaced with a NOOP. This wouldn't end well.\n\nUse a functionally equivalent test which doesn't dereference the pointer\nand always gives correct result.\n\nSomething has crashed my machine twice in recent days while playing with\nan Etron HC, and a control transfer stress test ran for confirmation has\njust crashed it again. The same test passes with this patch applied."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.89", "versionStartIncluding": "6.6.66"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.26", "versionStartIncluding": "6.12.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.5", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.11.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:42.473Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37813", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:00.500Z", "dateReserved": "2025-04-16T04:51:23.946Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-05-08T06:26:10.000Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/host/xhci-ring.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "142273a49f2c315eabdbdf5a71c15e479b75ca91", "status": "affected", "version": "fbc0a0c7718a6cb1dc5e0811a4f88a2b1deedfa1", "versionType": "git"}, {"lessThan": "bce3055b08e303e28a8751f6073066f5c33a0744", "status": "affected", "version": "9258c9ed32294ce3a4b58c9d92fc49ba030d35c9", "versionType": "git"}, {"lessThan": "0624e29c595b05e7a0e6d1c368f0a05799928e30", "status": "affected", "version": "5e1c67abc9301d05130b7e267c204e7005503b33", "versionType": "git"}, {"lessThan": "1ea050da5562af9b930d17cbbe9632d30f5df43a", "status": "affected", "version": "5e1c67abc9301d05130b7e267c204e7005503b33", "versionType": "git"}, {"status": "affected", "version": "4725344ca645a98a9d8e45e25b01a2244de5b8aa", "versionType": "git"}, {"lessThan": "6.6.89", "status": "affected", "version": "6.6.66", "versionType": "semver"}, {"lessThan": "6.12.26", "status": "affected", "version": "6.12.2", "versionType": "semver"}, {"lessThan": "6.12", "status": "affected", "version": "6.11.11", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/host/xhci-ring.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.89", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.26", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6FDE6FA3-7A79-4C87-96F2-B09634A5DCE5", "versionEndExcluding": "6.6.89", "versionStartIncluding": "6.6.66", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CBF5F6E-D446-4CAE-AAA4-413442319824", "versionEndExcluding": "6.12", "versionStartIncluding": "6.11.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "72659C84-F6D7-4B6C-8B36-B232E56EDB64", "versionEndExcluding": "6.12.26", "versionStartIncluding": "6.12.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B25CA7E-4CD0-46DB-B4EF-13A3516071FB", "versionEndExcluding": "6.14.5", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix invalid pointer dereference in Etron workaround\n\nThis check is performed before prepare_transfer() and prepare_ring(), so\nenqueue can already point at the final link TRB of a segment. And indeed\nit will, some 0.4% of times this code is called.\n\nThen enqueue + 1 is an invalid pointer. It will crash the kernel right\naway or load some junk which may look like a link TRB and cause the real\nlink TRB to be replaced with a NOOP. This wouldn't end well.\n\nUse a functionally equivalent test which doesn't dereference the pointer\nand always gives correct result.\n\nSomething has crashed my machine twice in recent days while playing with\nan Etron HC, and a control transfer stress test ran for confirmation has\njust crashed it again. The same test passes with this patch applied."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: xhci: Corregir desreferencia de puntero no v\u00e1lida en el workaround de Etron Esta comprobaci\u00f3n se realiza antes de prepare_transfer() y prepare_ring(), por lo que enqueue ya puede apuntar al TRB de enlace final de un segmento. Y de hecho lo har\u00e1, alrededor del 0,4% de las veces que se llama a este c\u00f3digo. Entonces enqueue + 1 es un puntero no v\u00e1lido. Har\u00e1 que el kernel se caiga de inmediato o cargar\u00e1 algo basura que puede parecer un TRB de enlace y hacer que el TRB de enlace real se reemplace con un NOOP. Esto no terminar\u00eda bien. Utilice una prueba funcionalmente equivalente que no desreferencia el puntero y siempre d\u00e9 un resultado correcto. Algo ha hecho que mi m\u00e1quina se caiga dos veces en los \u00faltimos d\u00edas mientras jugaba con un Etron HC, y una prueba de estr\u00e9s de transferencia de control ejecutada para confirmaci\u00f3n la acaba de hacer caer de nuevo. La misma prueba pasa con este parche aplicado."}], "id": "CVE-2025-37813", "lastModified": "2026-10-15T22:18:18.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37813", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:45:20.958093Z", "version": "2.0.3"}}]}, "published": "2025-05-08T07:15:52.523", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bce3055b08e303e28a8751f6073066f5c33a0744"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: xhci: Fix invalid pointer dereference in Etron workaround", "id": "2365012", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365012"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: xhci: Fix invalid pointer dereference in Etron workaround\nThis check is performed before prepare_transfer() and prepare_ring(), so\nenqueue can already point at the final link TRB of a segment. And indeed\nit will, some 0.4% of times this code is called.\nThen enqueue + 1 is an invalid pointer. It will crash the kernel right\naway or load some junk which may look like a link TRB and cause the real\nlink TRB to be replaced with a NOOP. This wouldn't end well.\nUse a functionally equivalent test which doesn't dereference the pointer\nand always gives correct result.\nSomething has crashed my machine twice in recent days while playing with\nan Etron HC, and a control transfer stress test ran for confirmation has\njust crashed it again. The same test passes with this patch applied."], "name": "CVE-2025-37813", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37813\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37813\nhttps://lore.kernel.org/linux-cve-announce/2025050817-CVE-2025-37813-8f2b@gregkh/T"], "threat_severity": "Moderate"}

{}