CVE-2025-37812

usb: cdns3: Fix deadlock when using NCM gadget

State: Published
Severity: Not scored
Published: May 8, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: Fix deadlock when using NCM gadget

The cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit 58f2fcb3a845 ("usb: cdnsp: Fix deadlock issue during using NCM gadget").

Under PREEMPT_RT the deadlock can be readily triggered by heavy network traffic, for example using "iperf --bidir" over NCM ethernet link.

The deadlock occurs because the threaded interrupt handler gets preempted by a softirq, but both are protected by the same spinlock. Prevent deadlock by disabling softirq during threaded irq handler.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7733f6c32e36ff9d7adadf40001039bf219b1cbe to before eebfb64c624fc738b669100173344fb441c5e719Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 59a760e4796a3cd88d8b9d7706e0a638de677751Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before b96239582531775f2fdcb14de29bdb6870fd4c8cAffected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before c27db84ed44e50ff90d9e3a2a25fae2e0a0fa015Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 48a62deb857f0694f611949015e70ad194d97159Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 74cd6e408a4c010e404832f0e4609d29bf1d0c41Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 09e90a9689a4aac7a2f726dc2aa472b0b37937b7Affected 7733f6c32e36ff9d7adadf40001039bf219b1cbe to before a1059896f2bfdcebcdc7153c3be2307ea319501fAffected
LinuxLinux	5.4Affected before 5.4Not affected 5.4.293 through 5.4.Not affected 5.10.237 through 5.10.Not affected 5.15.181 through 5.15.Not affected 6.1.136 through 6.1.Not affected 6.6.89 through 6.6.Not affected 6.12.26 through 6.12.Not affected 6.14.5 through 6.14.*Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

7733f6c32e36ff9d7adadf40001039bf219b1cbe to before eebfb64c624fc738b669100173344fb441c5e719Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 59a760e4796a3cd88d8b9d7706e0a638de677751Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before b96239582531775f2fdcb14de29bdb6870fd4c8cAffected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before c27db84ed44e50ff90d9e3a2a25fae2e0a0fa015Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 48a62deb857f0694f611949015e70ad194d97159Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 74cd6e408a4c010e404832f0e4609d29bf1d0c41Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before 09e90a9689a4aac7a2f726dc2aa472b0b37937b7Affected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to before a1059896f2bfdcebcdc7153c3be2307ea319501fAffected

LinuxLinux

5.4Affected
before 5.4Not affected
5.4.293 through 5.4.*Not affected
5.10.237 through 5.10.*Not affected
5.15.181 through 5.15.*Not affected
6.1.136 through 6.1.*Not affected
6.6.89 through 6.6.*Not affected
6.12.26 through 6.12.*Not affected
6.14.5 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.