Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-37800

In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential NULL pointer dereference in dev_uevent() If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it. Use WRITE_ONCE() when setting the driver pointer to ensure there is no tearing.

Published

2025-05-08T07:15:50.420

Last Modified

2025-06-05T14:32:50.747

Status

Analyzed

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity

CVSSv3.1: 5.5 (MEDIUM)

Weaknesses
  • Type: Primary
    CWE-476
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System linux linux_kernel < 6.6.89 Yes
Operating System linux linux_kernel < 6.12.26 Yes
Operating System linux linux_kernel < 6.14.5 Yes
Operating System linux linux_kernel 6.15 Yes
Operating System linux linux_kernel 6.15 Yes
Operating System linux linux_kernel 6.15 Yes
References