CVE-2025-37813 (GCVE-0-2025-37813)

Vulnerability from cvelistv5 – Published: 2025-05-08 06:26 – Updated: 2026-05-23 15:58
VLAI
Title
usb: xhci: Fix invalid pointer dereference in Etron workaround
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix invalid pointer dereference in Etron workaround This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a segment. And indeed it will, some 0.4% of times this code is called. Then enqueue + 1 is an invalid pointer. It will crash the kernel right away or load some junk which may look like a link TRB and cause the real link TRB to be replaced with a NOOP. This wouldn't end well. Use a functionally equivalent test which doesn't dereference the pointer and always gives correct result. Something has crashed my machine twice in recent days while playing with an Etron HC, and a control transfer stress test ran for confirmation has just crashed it again. The same test passes with this patch applied.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fbc0a0c7718a6cb1dc5e0811a4f88a2b1deedfa1 , < 142273a49f2c315eabdbdf5a71c15e479b75ca91 (git)
Affected: 9258c9ed32294ce3a4b58c9d92fc49ba030d35c9 , < bce3055b08e303e28a8751f6073066f5c33a0744 (git)
Affected: 5e1c67abc9301d05130b7e267c204e7005503b33 , < 0624e29c595b05e7a0e6d1c368f0a05799928e30 (git)
Affected: 5e1c67abc9301d05130b7e267c204e7005503b33 , < 1ea050da5562af9b930d17cbbe9632d30f5df43a (git)
Affected: 4725344ca645a98a9d8e45e25b01a2244de5b8aa (git)
Affected: 6.6.66 , < 6.6.89 (semver)
Affected: 6.12.2 , < 6.12.26 (semver)
Affected: 6.11.11 , < 6.12 (semver)
Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.6.89 , ≤ 6.6.* (semver)
Unaffected: 6.12.26 , ≤ 6.12.* (semver)
Unaffected: 6.14.5 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "142273a49f2c315eabdbdf5a71c15e479b75ca91",
              "status": "affected",
              "version": "fbc0a0c7718a6cb1dc5e0811a4f88a2b1deedfa1",
              "versionType": "git"
            },
            {
              "lessThan": "bce3055b08e303e28a8751f6073066f5c33a0744",
              "status": "affected",
              "version": "9258c9ed32294ce3a4b58c9d92fc49ba030d35c9",
              "versionType": "git"
            },
            {
              "lessThan": "0624e29c595b05e7a0e6d1c368f0a05799928e30",
              "status": "affected",
              "version": "5e1c67abc9301d05130b7e267c204e7005503b33",
              "versionType": "git"
            },
            {
              "lessThan": "1ea050da5562af9b930d17cbbe9632d30f5df43a",
              "status": "affected",
              "version": "5e1c67abc9301d05130b7e267c204e7005503b33",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4725344ca645a98a9d8e45e25b01a2244de5b8aa",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.89",
              "status": "affected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.26",
              "status": "affected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/host/xhci-ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.89",
                  "versionStartIncluding": "6.6.66",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "6.12.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.5",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix invalid pointer dereference in Etron workaround\n\nThis check is performed before prepare_transfer() and prepare_ring(), so\nenqueue can already point at the final link TRB of a segment. And indeed\nit will, some 0.4% of times this code is called.\n\nThen enqueue + 1 is an invalid pointer. It will crash the kernel right\naway or load some junk which may look like a link TRB and cause the real\nlink TRB to be replaced with a NOOP. This wouldn\u0027t end well.\n\nUse a functionally equivalent test which doesn\u0027t dereference the pointer\nand always gives correct result.\n\nSomething has crashed my machine twice in recent days while playing with\nan Etron HC, and a control transfer stress test ran for confirmation has\njust crashed it again. The same test passes with this patch applied."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:58:14.649Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91"
        },
        {
          "url": "https://git.kernel.org/stable/c/bce3055b08e303e28a8751f6073066f5c33a0744"
        },
        {
          "url": "https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a"
        }
      ],
      "title": "usb: xhci: Fix invalid pointer dereference in Etron workaround",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37813",
    "datePublished": "2025-05-08T06:26:10.000Z",
    "dateReserved": "2025-04-16T04:51:23.946Z",
    "dateUpdated": "2026-05-23T15:58:14.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37813",
      "date": "2026-05-27",
      "epss": "0.00065",
      "percentile": "0.20121"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37813\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-08T07:15:52.523\",\"lastModified\":\"2025-11-12T21:38:20.607\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: xhci: Fix invalid pointer dereference in Etron workaround\\n\\nThis check is performed before prepare_transfer() and prepare_ring(), so\\nenqueue can already point at the final link TRB of a segment. And indeed\\nit will, some 0.4% of times this code is called.\\n\\nThen enqueue + 1 is an invalid pointer. It will crash the kernel right\\naway or load some junk which may look like a link TRB and cause the real\\nlink TRB to be replaced with a NOOP. This wouldn\u0027t end well.\\n\\nUse a functionally equivalent test which doesn\u0027t dereference the pointer\\nand always gives correct result.\\n\\nSomething has crashed my machine twice in recent days while playing with\\nan Etron HC, and a control transfer stress test ran for confirmation has\\njust crashed it again. The same test passes with this patch applied.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: xhci: Corregir desreferencia de puntero no v\u00e1lida en el workaround de Etron Esta comprobaci\u00f3n se realiza antes de prepare_transfer() y prepare_ring(), por lo que enqueue ya puede apuntar al TRB de enlace final de un segmento. Y de hecho lo har\u00e1, alrededor del 0,4% de las veces que se llama a este c\u00f3digo. Entonces enqueue + 1 es un puntero no v\u00e1lido. Har\u00e1 que el kernel se caiga de inmediato o cargar\u00e1 algo basura que puede parecer un TRB de enlace y hacer que el TRB de enlace real se reemplace con un NOOP. Esto no terminar\u00eda bien. Utilice una prueba funcionalmente equivalente que no desreferencia el puntero y siempre d\u00e9 un resultado correcto. Algo ha hecho que mi m\u00e1quina se caiga dos veces en los \u00faltimos d\u00edas mientras jugaba con un Etron HC, y una prueba de estr\u00e9s de transferencia de control ejecutada para confirmaci\u00f3n la acaba de hacer caer de nuevo. La misma prueba pasa con este parche aplicado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.66\",\"versionEndExcluding\":\"6.6.89\",\"matchCriteriaId\":\"6FDE6FA3-7A79-4C87-96F2-B09634A5DCE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11.11\",\"versionEndExcluding\":\"6.12\",\"matchCriteriaId\":\"4CBF5F6E-D446-4CAE-AAA4-413442319824\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.2\",\"versionEndExcluding\":\"6.12.26\",\"matchCriteriaId\":\"72659C84-F6D7-4B6C-8B36-B232E56EDB64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.5\",\"matchCriteriaId\":\"6B25CA7E-4CD0-46DB-B4EF-13A3516071FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0624e29c595b05e7a0e6d1c368f0a05799928e30\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/142273a49f2c315eabdbdf5a71c15e479b75ca91\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ea050da5562af9b930d17cbbe9632d30f5df43a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bce3055b08e303e28a8751f6073066f5c33a0744\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.