CVE-2025-37801: spi: spi-imx: Add check for spi_imx_setupxfer()
First published: Thu May 08 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: spi: spi-imx: Add check for spi_imx_setupxfer() Add check for the return value of spi_imx_setupxfer(). spi_imx->rx and spi_imx->tx function pointer can be NULL when spi_imx_setupxfer() return error, and make NULL pointer dereference. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: 0x0 spi_imx_pio_transfer+0x50/0xd8 spi_imx_transfer_one+0x18c/0x858 spi_transfer_one_message+0x43c/0x790 __spi_pump_transfer_message+0x238/0x5d4 __spi_sync+0x2b0/0x454 spi_write_then_read+0x11c/0x200
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/2fea0d6d7b5d27fbf55512d51851ba0a346ede52
- https://git.kernel.org/stable/c/2b4479eb462ecb39001b38dfb331fc6028dedac8
- https://git.kernel.org/stable/c/185d376875ea6fb4256b9dc97ee0b4d2b0fdd399
- https://git.kernel.org/stable/c/055ef73bb1afc3f783a9a13b496770a781964a07
- https://git.kernel.org/stable/c/951a04ab3a2db4029debfa48d380ef834b93207e
Frequently Asked Questions
What is the severity of CVE-2025-37801?
The severity of CVE-2025-37801 is considered high due to potential NULL pointer dereference risks in the Linux kernel.
How do I fix CVE-2025-37801?
To fix CVE-2025-37801, update to the patched version of the Linux kernel that includes the necessary checks for spi_imx_setupxfer().
What impact does CVE-2025-37801 have on system security?
CVE-2025-37801 could lead to system instability or crashes if NULL function pointers are dereferenced, posing potential security risks.
Is my system vulnerable to CVE-2025-37801?
Your system may be vulnerable to CVE-2025-37801 if it is running an affected version of the Linux kernel prior to the patch.
What systems are affected by CVE-2025-37801?
CVE-2025-37801 affects the Linux kernel, particularly implementations that utilize the spi-imx driver without the fix applied.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/linux
- canonical/linux kernel