CVE-2025-37801: spi: spi-imx: Add check for spi_imx_setupxfer()
In the Linux kernel, the following vulnerability has been resolved:
spi: spi-imx: Add check for spiimxsetupxfer()
Add check for the return value of spiimxsetupxfer(). spiimx->rx and spiimx->tx function pointer can be NULL when spiimxsetupxfer() return error, and make NULL pointer dereference.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: 0x0 spiimxpiotransfer+0x50/0xd8 spiimxtransferone+0x18c/0x858 spitransferonemessage+0x43c/0x790 spipumptransfermessage+0x238/0x5d4 spisync+0x2b0/0x454 spiwritethenread+0x11c/0x200
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.92.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37801?
The severity of CVE-2025-37801 is considered high due to potential NULL pointer dereference risks in the Linux kernel.
How do I fix CVE-2025-37801?
To fix CVE-2025-37801, update to the patched version of the Linux kernel that includes the necessary checks for spi_imx_setupxfer().
What impact does CVE-2025-37801 have on system security?
CVE-2025-37801 could lead to system instability or crashes if NULL function pointers are dereferenced, posing potential security risks.
Is my system vulnerable to CVE-2025-37801?
Your system may be vulnerable to CVE-2025-37801 if it is running an affected version of the Linux kernel prior to the patch.
What systems are affected by CVE-2025-37801?
CVE-2025-37801 affects the Linux kernel, particularly implementations that utilize the spi-imx driver without the fix applied.