CVE-2025-37842

low-risk
Published 2025-05-09

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kernel panic. Drop the remove function and use devm_add_action_or_reset() for driver cleanup to ensure the release sequence. Trigger kernel panic on i.MX8MQ by echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Linux

References (5)

Patch https://git.kernel.org/stable/c/40369bfe717e96e26650eeecfa5a6363563df6e4
Patch https://git.kernel.org/stable/c/439688dbe82baa10d4430dc3252bb5ef1183a171
Patch https://git.kernel.org/stable/c/50ae352c1848cab408fb4f7d7f50c71f818bbdbf
Patch https://git.kernel.org/stable/c/f68b27d82a749117d9c7d7f33fa53f46373e38e2
Patch https://git.kernel.org/stable/c/f9bfb3a5f6f616f3eb7665c8ff3bcb9760ae33c8
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal