CVE-2025-37994

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: displayport: Fix NULL pointer access

This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the partner removal.

This flaw is rated as Moderate severity rather than Important because it only causes a local denial of service (kernel crash) and cannot be exploited remotely or leveraged for privilege escalation. Exploitation requires physical hardware interactions, specifically disconnecting a USB Type-C DisplayPort partner device while background workqueue operations are still active. Standard enterprise server and virtualized environments rarely utilize UCSI hardware controllers, significantly limiting exposure across typical Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.