{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37977", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.975Z", "datePublished": "2025-05-20T16:58:20.693Z", "dateUpdated": "2026-08-05T11:58:43.660Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:43.660Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: exynos: Disable iocc if dma-coherent property isn't set\n\nIf dma-coherent property isn't set then descriptors are non-cacheable\nand the iocc shareability bits should be disabled. Without this UFS can\nend up in an incompatible configuration and suffer from random cache\nrelated stability issues." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is an Exynos UFS host controller driver path programmed at probe time and exercised by ordinary block/filesystem I/O to the local storage device. There is no network-facing consumer, so reaching it requires local access to issue I/O.\nAC:L - The coherency configuration is systematically wrong on every transfer on affected platforms — not a narrow race the attacker must win — and a local process can reliably drive sustained UFS I/O plus cache pressure to surface the incoherency. No precondition lies outside the attacker's influence.\nPR:L - Any unprivileged local process can generate the UFS traffic that flows through the mismatched descriptor rings and streaming DMA mappings via normal file reads and writes. No capability or root access is needed.\nUI:N - The broken shareability programming is applied at driver probe and takes effect on all subsequent I/O; no victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - The incoherent DMA is confined to buffers the kernel itself mapped for the UFS controller, so the impact stays within the kernel/OS security authority. It is a cache shareability attribute mismatch, not an IOMMU or DMA-boundary bypass.\nC:H - With DMA_FROM_DEVICE the post-transfer invalidate can discard the device-written line, leaving the CPU to read the physical page's prior contents — previously freed kernel or other-process memory — and return it to userspace as file data. The driver likewise consumes stale device-written response UPIU and sense data from non-cacheable descriptor memory.\nI:H - Device writes can be dropped and stale cache contents flushed to the storage device, corrupting file data and filesystem metadata on the primary boot medium, and the driver acts on stale descriptor/status fields it believes the controller wrote.\nA:H - The commit explicitly cites random cache-related stability issues; incoherent UTRD/UTMRD rings lead to misparsed completions, I/O timeouts, controller resets, hangs and kernel crashes on the root storage device." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/ufs/host/ufs-exynos.c", "drivers/ufs/host/ufs-exynos.h" ], "versions": [ { "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "lessThan": "869749e48115ef944eeabec8e84138908471fa51", "status": "affected", "versionType": "git" }, { "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "lessThan": "f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51", "status": "affected", "versionType": "git" }, { "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f", "lessThan": "f92bb7436802f8eb7ee72dc911a33c8897fde366", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/ufs/host/ufs-exynos.c", "drivers/ufs/host/ufs-exynos.h" ], "versions": [ { "version": "5.16", "status": "affected" }, { "version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.26", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.4", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.26" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.14.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/869749e48115ef944eeabec8e84138908471fa51" }, { "url": "https://git.kernel.org/stable/c/f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51" }, { "url": "https://git.kernel.org/stable/c/f92bb7436802f8eb7ee72dc911a33c8897fde366" } ], "title": "scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set", "x_generator": { "engine": "bippy-1.2.0" } } } }