CVE-2025-37838: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
HSI: ssiprotocol: Fix use after free vulnerability in ssiprotocol Driver Due to Race Condition
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure that the work is canceled before proceeding with cleanup in the ssi_protocol driver (cancel the ssi->work before kfree(ssi) / during ssi_protocol_remove) to prevent the UAF race described between ssi_protocol_remove and ssip_xmit_work/ssip_pn_xmit().
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37838?
CVE-2025-37838 has been classified as a critical vulnerability due to its potential to allow exploitation through a race condition.
How do I fix CVE-2025-37838?
To fix CVE-2025-37838, update your Linux kernel to the latest available version that addresses this vulnerability.
What systems are affected by CVE-2025-37838?
CVE-2025-37838 affects the Linux kernel, specifically systems running versions that include the vulnerable ssi_protocol driver.
What is the impact of CVE-2025-37838?
The impact of CVE-2025-37838 includes potential denial of service or arbitrary code execution due to a use after free vulnerability.
Is there a workaround for CVE-2025-37838?
Currently, there are no known workarounds for CVE-2025-37838, so applying the kernel update is the recommended action.