CVE-2025-37813

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix invalid pointer dereference in Etron workaround

This check is performed before prepare_transfer() and prepare_ring(), so enqueue can already point at the final link TRB of a segment. And indeed it will, some 0.4% of times this code is called.

Then enqueue + 1 is an invalid pointer. It will crash the kernel right away or load some junk which may look like a link TRB and cause the real link TRB to be replaced with a NOOP. This wouldn't end well.

Use a functionally equivalent test which doesn't dereference the pointer and always gives correct result.

Something has crashed my machine twice in recent days while playing with an Etron HC, and a control transfer stress test ran for confirmation has just crashed it again. The same test passes with this patch applied.

This vulnerability is rated as Moderate severity because exploitation requires local access on a system with specific third-party hardware, limiting the attack surface to hosts utilizing Etron USB host controllers. In typical enterprise deployments of Red Hat Enterprise Linux, systems rarely contain Etron xHCI hardware, and standard host controllers from other vendors do not trigger the affected driver workaround. Where vulnerable hardware is present, an attacker with local privileges capable of initiating USB control transfers could trigger an out-of-bounds memory read, resulting in a system denial of service or potential kernel instability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.