CVE-2025-37993: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37993 is a vulnerability in the Linux kernel related to an uninitialized spin lock in the CAN bus subsystem. The vulnerability was disclosed on May 29, 2025, affecting the txhandlingspinlock in struct mcanclassdev which is not properly initialized during device probe (NVD, Wiz).

The vulnerability occurs in the mcanclassallocatedev function where the spin lock txhandlingspinlock in struct mcanclassdev is not properly initialized. When attempting to send CAN frames using can-utils, this results in a spinlock bad magic complaint from the kernel. The issue has been assigned a CVSS v3.1 base score of 7.0 with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Wiz).

The vulnerability affects the CAN bus functionality in the Linux kernel, causing kernel complaints and potential system instability when attempting to send CAN frames. This issue particularly impacts systems utilizing the CAN bus subsystem (Wiz).

The issue has been fixed by initializing the spin lock in mcanclassallocatedev. Fixed versions are available in various Linux distributions, including Debian sid 6.12.30-1 and other updated kernel versions (Debian).