CVE-2025-37812: usb: cdns3: Fix deadlock when using NCM gadget
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: Fix deadlock when using NCM gadget
The cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit 58f2fcb3a845 ("usb: cdnsp: Fix deadlock issue during using NCM gadget").
Under PREEMPTRT the deadlock can be readily triggered by heavy network traffic, for example using "iperf --bidir" over NCM ethernet link.
The deadlock occurs because the threaded interrupt handler gets preempted by a softirq, but both are protected by the same spinlock. Prevent deadlock by disabling softirq during threaded irq handler.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37812?
CVE-2025-37812 has been classified as a medium severity vulnerability.
How do I fix CVE-2025-37812?
To fix CVE-2025-37812, update your Linux kernel to the latest version where the deadlock issue has been resolved.
What systems are affected by CVE-2025-37812?
CVE-2025-37812 affects systems running the Linux kernel that utilize the cdns3 driver.
What type of vulnerability is CVE-2025-37812?
CVE-2025-37812 is a deadlock vulnerability in the USB subsystem of the Linux kernel.
Can CVE-2025-37812 be exploited remotely?
CVE-2025-37812 does not describe a vulnerability that can be easily exploited remotely; it primarily affects local usage of the NCM gadget.