CVE-2025-37813: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37813 is a vulnerability discovered in the Linux kernel's USB XHCI driver, specifically affecting the Etron workaround implementation. The vulnerability was disclosed on May 8, 2025, and affects various Linux distributions including Ubuntu's newer releases (24.04 LTS noble, 24.10 oracular, and 25.04 plucky) and Red Hat Enterprise Linux 9 (NVD, Red Hat).

The vulnerability stems from an invalid pointer dereference in the Etron workaround implementation within the USB XHCI driver. The issue occurs when the enqueue pointer points to the final link TRB (Transfer Request Block) of a segment, which happens approximately 0.4% of the time. The check is performed before preparetransfer() and preparering() functions, leading to an invalid pointer when incrementing the enqueue pointer. This can result in immediate kernel crashes or corruption of the TRB chain (Red Hat). The vulnerability has been assigned a CVSS v3.1 base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high severity with local access requirements (Red Hat).

The vulnerability can cause system crashes and potential memory corruption when exploited. When triggered, it either crashes the kernel immediately or loads incorrect data that may appear as a link TRB, causing the real link TRB to be replaced with a NOOP operation. This can lead to system instability and potential privilege escalation (NVD).

A patch has been developed that implements a functionally equivalent test which doesn't dereference the pointer and always gives correct results. The fix has been confirmed to prevent the crashes during stress testing. Various Linux distributions have different statuses regarding the fix: Red Hat Enterprise Linux 9 has deferred the fix, while older versions (RHEL 8 and below) are either not affected or out of support scope. Ubuntu has marked several recent versions as vulnerable, including 24.04 LTS noble, 24.10 oracular, and 25.04 plucky, while older versions are not affected (Ubuntu, Red Hat).