CVE-2025-37970: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37970 is a vulnerability discovered in the Linux kernel's IIO (Industrial I/O) subsystem, specifically affecting the ST LSM6DSX IMU driver. The vulnerability was disclosed on May 20, 2025, and involves a potential lockup condition in the stlsm6dsxread_fifo function (NVD, Wiz).

The vulnerability occurs when the patternlen parameter is equal to zero while the device FIFO is not empty, which can cause stlsm6dsxreadfifo to fall into an infinite loop. This condition creates a potential lockup situation in the driver's FIFO reading functionality. The vulnerability has been assigned a CVSS v3.1 score of 7.0 with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Red Hat).

The vulnerability could lead to a system lockup when reading data from the ST LSM6DSX IMU device's FIFO buffer, potentially affecting system stability and performance (Wiz).

The vulnerability has been resolved in the Linux kernel through a patch that prevents the infinite loop condition in stlsm6dsxreadfifo when patternlen is zero and the device FIFO is not empty. For the Debian stable distribution (bookworm), these problems have been fixed in version 6.1.140-1 (Debian).