CVE-2025-37985

In the Linux kernel, the following vulnerability has been resolved:

USB: wdm: close race between wdm_open and wdm_wwan_port_stop

Clearing WDM_WWAN_IN_USE must be the last action or we can open a chardev whose URBs are still poisoned

The bug actual only if WMC Device Management functionality being used (that is for the cell phones compliant to the CDC WMC specification). It is about possibility of incorrect access to the device (can access after release of the device). It doesn't lead to kernel crash or other possibilities of attack, so the security impact is limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module cdc-wdm from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.