CVE-2025-37985: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37985 is a vulnerability discovered in the Linux kernel on May 20, 2025, specifically affecting the USB WDM (Wireless WAN) component. The vulnerability involves a race condition between wdmopen and wdmwwanportstop functions where clearing the WDMWWANIN_USE flag is not properly synchronized (NVD CVE, Wiz Report).

The vulnerability stems from a timing issue in the USB WDM component where clearing WDMWWANINUSE flag is not properly synchronized, potentially leading to a situation where a character device can be opened while its URBs (USB Request Blocks) are still poisoned. This race condition occurs between the wdmopen and wdmwwanport_stop operations (Wiz Report).

The vulnerability could potentially lead to system instability or information disclosure due to accessing poisoned URBs in the USB subsystem (Wiz Report).

Multiple Linux distributions are working on patches. Ubuntu has marked this vulnerability as 'work in progress' for version 25.04 and 'vulnerable' for versions 24.10, 24.04 LTS, and 22.04 LTS. Earlier versions (20.04 LTS, 18.04 LTS, 16.04 LTS, and 14.04 LTS) are not affected (Ubuntu Security).