CVE-2025-37994: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37994 is a vulnerability discovered in the Linux kernel affecting the USB Type-C UCSI DisplayPort functionality. The vulnerability was disclosed on May 29, 2025, and involves a NULL pointer access issue in the UCSI driver's DisplayPort implementation (NVD Database).

The vulnerability exists in the Linux kernel's USB Type-C UCSI DisplayPort subsystem where the UCSI driver fails to properly handle pending tasks in the ucsidisplayportwork workqueue before partner removal. According to Red Hat's assessment, this vulnerability has been assigned a CVSS v3 Base Score of 7.0 with Local attack vector and High attack complexity (Wiz Report).

The vulnerability could potentially lead to NULL pointer dereference issues when handling DisplayPort connections through the USB Type-C UCSI interface, which might result in system instability or crashes (Debian Tracker).

The vulnerability has been patched in various Linux distributions. Debian has fixed the issue in version 6.1.140-1 for bookworm and 6.12.30-1 for sid releases. The fix ensures that the UCSI driver properly waits for all pending tasks in the ucsidisplayportwork workqueue to finish executing before proceeding with partner removal (Debian Tracker).