CVE-2025-37801

spi: spi-imx: Add check for spi_imx_setupxfer()

Description

In the Linux kernel, the following vulnerability has been resolved: spi: spi-imx: Add check for spi_imx_setupxfer() Add check for the return value of spi_imx_setupxfer(). spi_imx->rx and spi_imx->tx function pointer can be NULL when spi_imx_setupxfer() return error, and make NULL pointer dereference. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: 0x0 spi_imx_pio_transfer+0x50/0xd8 spi_imx_transfer_one+0x18c/0x858 spi_transfer_one_message+0x43c/0x790 __spi_pump_transfer_message+0x238/0x5d4 __spi_sync+0x2b0/0x454 spi_write_then_read+0x11c/0x200

Category

5.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.02%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/2fea0d6d7b5d27fbf55512d51851ba0a346ede52 patch
https://git.kernel.org/stable/c/2b4479eb462ecb39001b38dfb331fc6028dedac8 patch
https://git.kernel.org/stable/c/185d376875ea6fb4256b9dc97ee0b4d2b0fdd399 patch
https://git.kernel.org/stable/c/055ef73bb1afc3f783a9a13b496770a781964a07 patch
https://git.kernel.org/stable/c/951a04ab3a2db4029debfa48d380ef834b93207e patch

Frequently Asked Questions

What is the severity of CVE-2025-37801?
CVE-2025-37801 has been scored as a medium severity vulnerability.
How to fix CVE-2025-37801?
To fix CVE-2025-37801, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-37801 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-37801 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-37801?
CVE-2025-37801 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.