CVE-2025-37977

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37977", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.975Z", "datePublished": "2025-05-20T16:58:20.693Z", "dateUpdated": "2026-10-30T12:21:30.667Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:21:30.667Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: exynos: Disable iocc if dma-coherent property isn't set\n\nIf dma-coherent property isn't set then descriptors are non-cacheable\nand the iocc shareability bits should be disabled. Without this UFS can\nend up in an incompatible configuration and suffer from random cache\nrelated stability issues."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is an Exynos UFS host controller driver path programmed at probe time and exercised by ordinary block/filesystem I/O to the local storage device. There is no network-facing consumer, so reaching it requires local access to issue I/O.\nAC:L - The coherency configuration is systematically wrong on every transfer on affected platforms \u2014 not a narrow race the attacker must win \u2014 and a local process can reliably drive sustained UFS I/O plus cache pressure to surface the incoherency. No precondition lies outside the attacker's influence.\nPR:L - Any unprivileged local process can generate the UFS traffic that flows through the mismatched descriptor rings and streaming DMA mappings via normal file reads and writes. No capability or root access is needed.\nUI:N - The broken shareability programming is applied at driver probe and takes effect on all subsequent I/O; no victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - The incoherent DMA is confined to buffers the kernel itself mapped for the UFS controller, so the impact stays within the kernel/OS security authority. It is a cache shareability attribute mismatch, not an IOMMU or DMA-boundary bypass.\nC:H - With DMA_FROM_DEVICE the post-transfer invalidate can discard the device-written line, leaving the CPU to read the physical page's prior contents \u2014 previously freed kernel or other-process memory \u2014 and return it to userspace as file data. The driver likewise consumes stale device-written response UPIU and sense data from non-cacheable descriptor memory.\nI:H - Device writes can be dropped and stale cache contents flushed to the storage device, corrupting file data and filesystem metadata on the primary boot medium, and the driver acts on stale descriptor/status fields it believes the controller wrote.\nA:H - The commit explicitly cites random cache-related stability issues; incoherent UTRD/UTMRD rings lead to misparsed completions, I/O timeouts, controller resets, hangs and kernel crashes on the root storage device."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/host/ufs-exynos.c", "drivers/ufs/host/ufs-exynos.h"], "versions": [{"version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "lessThan": "aa64b94202d4453d616873ce318e19b064dfce04", "status": "affected", "versionType": "git"}, {"version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "lessThan": "b101fc9ac18d1ac434b703839a5117342a591792", "status": "affected", "versionType": "git"}, {"version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "lessThan": "869749e48115ef944eeabec8e84138908471fa51", "status": "affected", "versionType": "git"}, {"version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "lessThan": "f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51", "status": "affected", "versionType": "git"}, {"version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "lessThan": "f92bb7436802f8eb7ee72dc911a33c8897fde366", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/ufs/host/ufs-exynos.c", "drivers/ufs/host/ufs-exynos.h"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.4", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.14.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/aa64b94202d4453d616873ce318e19b064dfce04"}, {"url": "https://git.kernel.org/stable/c/b101fc9ac18d1ac434b703839a5117342a591792"}, {"url": "https://git.kernel.org/stable/c/869749e48115ef944eeabec8e84138908471fa51"}, {"url": "https://git.kernel.org/stable/c/f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51"}, {"url": "https://git.kernel.org/stable/c/f92bb7436802f8eb7ee72dc911a33c8897fde366"}], "title": "scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/ufs/host/ufs-exynos.c", "drivers/ufs/host/ufs-exynos.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "aa64b94202d4453d616873ce318e19b064dfce04", "status": "affected", "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "versionType": "git"}, {"lessThan": "b101fc9ac18d1ac434b703839a5117342a591792", "status": "affected", "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "versionType": "git"}, {"lessThan": "869749e48115ef944eeabec8e84138908471fa51", "status": "affected", "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "versionType": "git"}, {"lessThan": "f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51", "status": "affected", "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "versionType": "git"}, {"lessThan": "f92bb7436802f8eb7ee72dc911a33c8897fde366", "status": "affected", "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/ufs/host/ufs-exynos.c", "drivers/ufs/host/ufs-exynos.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.26", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A259054-CC63-4AE5-8BEB-9ACF595750B1", "versionEndExcluding": "6.12.26", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "29FA1A8E-1C2A-4B0B-B397-2C915ECDEDEE", "versionEndExcluding": "6.14.4", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: exynos: Disable iocc if dma-coherent property isn't set\n\nIf dma-coherent property isn't set then descriptors are non-cacheable\nand the iocc shareability bits should be disabled. Without this UFS can\nend up in an incompatible configuration and suffer from random cache\nrelated stability issues."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: ufs: exynos: Deshabilitar iocc si la propiedad dma-coherent no est\u00e1 establecida. Si la propiedad dma-coherent no est\u00e1 establecida, los descriptores no se pueden almacenar en cach\u00e9 y los bits de compartici\u00f3n de iocc deben estar deshabilitados. Sin esto, UFS puede terminar en una configuraci\u00f3n incompatible y sufrir problemas de estabilidad aleatorios relacionados con la cach\u00e9."}], "id": "CVE-2025-37977", "lastModified": "2026-10-30T13:17:59.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-05-20T17:15:48.320", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/869749e48115ef944eeabec8e84138908471fa51"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aa64b94202d4453d616873ce318e19b064dfce04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b101fc9ac18d1ac434b703839a5117342a591792"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f92bb7436802f8eb7ee72dc911a33c8897fde366"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set", "id": "2367606", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2367606"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: ufs: exynos: Disable iocc if dma-coherent property isn't set\nIf dma-coherent property isn't set then descriptors are non-cacheable\nand the iocc shareability bits should be disabled. Without this UFS can\nend up in an incompatible configuration and suffer from random cache\nrelated stability issues."], "name": "CVE-2025-37977", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37977\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37977\nhttps://lore.kernel.org/linux-cve-announce/2025052039-CVE-2025-37977-9862@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-06-24T09:44:23.164758+00:00", "updated": "2025-06-24T09:44:23.164811+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}