What’s Vulnerable › Vulnerabilities

CVE-2025-37811: usb: chipidea: ci_hdrc_imx: fix usbmisc handling

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-08 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: ci_hdrc_imx: fix usbmisc handling usbmisc is an optional device property so it is totally valid for the corresponding data->usbmisc_data to have a NULL value. Check that before dereferencing the pointer. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 5.15.179 before 5.15.181; from 6.1.129 before 6.1.136; from 6.6.72 before 6.6.89; from 6.12.10 before 6.12.26; from 6.13.1 before 6.14.5; 6.13, 6.13-rc7, 6.15-rc1, 6.15-rc2, 6.15-rc3 — fixed in 5.15.181, 6.1.136, 6.12.26, 6.14.5, 6.6.89

How to fix

Upgrade to a fixed version: Linux kernel 5.15.181, 6.1.136, 6.12.26, 6.14.5. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0ee460498ced49196149197c9f6d29a10e5e0798
• https://git.kernel.org/stable/c/121e9f80ea5478bca3a8f3f26593fd66f87da649
• https://git.kernel.org/stable/c/2aa87bd825377f5073b76701780a902cd0fc725a
• https://git.kernel.org/stable/c/4e28f79e3dffa52d327b46d1a78dac16efb5810b
• https://git.kernel.org/stable/c/8060b719676e8c0e5a2222c2977ba0458d9d9535
• https://git.kernel.org/stable/c/887902ca73490f38c69fd6149ef361a041cf912f
• https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Get alerted when CVE-2025-37811 or the next vulnerability affects your stack