CVE-2025-37842: spi: fsl-qspi: use devm function instead of driver remove
In the Linux kernel, the following vulnerability has been resolved:
spi: fsl-qspi: use devm function instead of driver remove
Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kernel panic. Drop the remove function and use devmaddactionorreset() for driver cleanup to ensure the release sequence.
Trigger kernel panic on i.MX8MQ by echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37842?
CVE-2025-37842 is classified with a medium severity level due to potential resource management issues.
How do I fix CVE-2025-37842?
To fix CVE-2025-37842, update the Linux kernel to a version that implements the devm API for better resource handling.
What systems are affected by CVE-2025-37842?
CVE-2025-37842 affects systems running vulnerable versions of the Linux kernel that utilize the fsl-qspi driver.
What type of vulnerability is CVE-2025-37842?
CVE-2025-37842 is a resource management vulnerability related to driver handling in the Linux kernel.
Is there a known exploit for CVE-2025-37842?
As of now, there are no public exploits reported for CVE-2025-37842.