CVE-2025-37968: iio: light: opt3001: fix deadlock due to concurrent flag access
In the Linux kernel, the following vulnerability has been resolved:
iio: light: opt3001: fix deadlock due to concurrent flag access
The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutexlock stage and false at the mutexunlock stage. This results in the mutex not being unlocked, resulting in a deadlock.
Fix it by making the opt3001irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37968?
CVE-2025-37968 is classified as a vulnerability affecting the Linux kernel due to potential deadlock issues.
How do I fix CVE-2025-37968?
To fix CVE-2025-37968, update to the patched version of the Linux kernel that addresses the concurrent flag access issue.
What systems are affected by CVE-2025-37968?
CVE-2025-37968 affects systems running vulnerable versions of the Linux kernel with the opt3001 light sensor driver.
What type of vulnerability is CVE-2025-37968?
CVE-2025-37968 is a concurrent access vulnerability related to a mutex lock in the Linux kernel driver.
Is CVE-2025-37968 actively exploited?
As of the latest updates, there is no information indicating that CVE-2025-37968 is actively exploited in the wild.