Riskcovery

CVE-2025-37813

usb: xhci: Fix invalid pointer dereference in Etron workaround

State
Published
Severity
7.8 High
Published
May 8, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix invalid pointer dereference in Etron workaround

This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a segment. And indeed it will, some 0.4% of times this code is called.

Then enqueue + 1 is an invalid pointer. It will crash the kernel right away or load some junk which may look like a link TRB and cause the real link TRB to be replaced with a NOOP. This wouldn't end well.

Use a functionally equivalent test which doesn't dereference the pointer and always gives correct result.

Something has crashed my machine twice in recent days while playing with an Etron HC, and a control transfer stress test ran for confirmation has just crashed it again. The same test passes with this patch applied.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • fbc0a0c7718a6cb1dc5e0811a4f88a2b1deedfa1 to before 142273a49f2c315eabdbdf5a71c15e479b75ca91Affected
  • 9258c9ed32294ce3a4b58c9d92fc49ba030d35c9 to before bce3055b08e303e28a8751f6073066f5c33a0744Affected
  • 5e1c67abc9301d05130b7e267c204e7005503b33 to before 0624e29c595b05e7a0e6d1c368f0a05799928e30Affected
  • 5e1c67abc9301d05130b7e267c204e7005503b33 to before 1ea050da5562af9b930d17cbbe9632d30f5df43aAffected
  • 4725344ca645a98a9d8e45e25b01a2244de5b8aaAffected
  • 6.6.66 to before 6.6.89Affected
  • 6.12.2 to before 6.12.26Affected
  • 6.11.11 to before 6.12Affected
LinuxLinux
  • 6.13Affected
  • before 6.13Not affected
  • 6.6.89 through 6.6.*Not affected
  • 6.12.26 through 6.12.*Not affected
  • 6.14.5 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.