CVE-2025-37882
kernel: Linux kernel: xHCI driver isochronous event handling race condition leading to data loss or UAF
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 9, 2025
Updated · July 30, 2026
Description
A flaw was found in the Linux kernel's xHCI (eXtensible Host Controller Interface) driver. This vulnerability allows data loss or buffer Use-After-Free (UAF) due to a race condition during isochronous Ring Underrun/Overrun event handling.
Statement
This Moderate impact flaw in the Linux kernel's xHCI driver can lead to data loss or Use-After-Free conditions due to a race condition during isochronous event handling by an local attacker with a special privilege. This affects Red Hat Enterprise Linux systems utilizing USB 3.0 host controllers. Exploitation requires interaction with xHCI devices.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition