CVE-2025-37853: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37853 is a vulnerability discovered in the Linux kernel, specifically affecting the drm/amdkfd debugfs hang_hws functionality. The vulnerability was published on May 9, 2025, and affects various Linux distributions including Ubuntu and Debian systems (NVD, Wiz).

The vulnerability occurs in the debugfs hang_hws component when used with GPU reset test with HWS. For MES (Memory Encryption System) configurations, this causes a kernel crash due to NULL pointer access because dqm->packet_mgr is not properly set up for the MES path. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Wiz).

When exploited, this vulnerability results in a kernel crash through NULL pointer access, potentially leading to system unavailability. The impact is primarily focused on system availability with no direct effect on confidentiality or integrity (Wiz).

The vulnerability requires local access to the system and low attack complexity. No public exploits have been reported, and the vulnerability is not listed in CISA KEV (Wiz).

As a temporary mitigation, the system now skips GPU with MES for the hang_hws debugfs interface. A proper MES hang_hws debugfs interface support is planned for future implementation. Fixed versions are available in Debian trixie (6.12.25-1) and sid (6.12.27-1) releases (Wiz).