CVE-2025-37853: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37853 is a vulnerability discovered in the Linux kernel, specifically affecting the drm/amdkfd debugfs hang_hws functionality. The vulnerability was published on May 9, 2025, and affects various Linux distributions including Ubuntu and Debian systems (NVD, Wiz).

The vulnerability occurs in the debugfs hang_hws component when used with GPU reset test with HWS. For MES (Memory Encryption System) configurations, this causes a kernel crash due to NULL pointer access because dqm->packet_mgr is not properly set up for the MES path. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Wiz).

When exploited, this vulnerability results in a kernel crash through NULL pointer access, potentially leading to system unavailability. The impact is primarily focused on system availability with no direct effect on confidentiality or integrity (Wiz).

As a temporary mitigation, the system now skips GPU with MES for the hang_hws debugfs interface. A proper MES hang_hws debugfs interface support is planned for future implementation. Fixed versions are available in Debian trixie (6.12.25-1) and sid (6.12.27-1) releases (Wiz).