CVE-2025-37968 — Improper Locking in Linux
Severity
5.5MEDIUMNVD
OSV7.8OSV3.2
EPSS
0.1%
top 74.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 20
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
iio: light: opt3001: fix deadlock due to concurrent flag access
The threaded IRQ function in this driver is reading the flag twice: once to
lock a mutex and once to unlock it. Even though the code setting the flag
is designed to prevent it, there are subtle cases where the flag could be
true at the mutex_lock stage and false at the mutex_unlock stage. This
results in the mutex not being unlocked, resulting in a deadlock.
Fix …
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages8 packages
▶CVEListV5linux/linux94a9b7b1809f56cfaa080e70ec49b6979563a237 — a9c56ccb7cddfca754291fb24b108a5350a5fbe9+8
Also affects: Debian Linux 11.0