Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-37802
CVE-2025-37802:
Linux Debian vulnerability analysis and mitigation
Overview
CVE-2025-37802 is a vulnerability discovered in the Linux kernel, specifically affecting the ksmbd component. The vulnerability was disclosed on May 8, 2025, and involves an issue where ksmbddurablescavenger_alive() attempts to acquire a mutex while in a sleeping state (NVD).
Technical details
The vulnerability occurs when waiteventtimeout() sets the current task state to TASKUNINTERRUPTIBLE before performing the condition check. This leads to ksmbddurablescavengeralive() attempting to acquire a mutex while already in a sleeping state, triggering a scheduler warning: 'do not call blocking ops when !TASKRUNNING; state=2'. The issue was identified at the preparetowaitevent+0x9f/0x6c0 location (NVD).
Impact
The vulnerability affects multiple Linux distributions including Ubuntu versions 16.04 through 25.04, and various kernel configurations including AWS, Azure, and GCP deployments. Multiple Ubuntu releases are marked as vulnerable, including the latest LTS versions (Ubuntu).
Mitigation and workarounds
The vulnerability has been addressed in some distributions, with fixes being rolled out across different versions. Debian 13 has implemented a fix, while Debian 11 and 12 remain without fixes. Ubuntu has marked this as a medium priority issue and is working on updates for affected versions (Wiz).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management