usb: chipidea: ci_hdrc_imx: fix usbmisc handling

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2025-37811
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-05-08 07:15:52 UTC
Updated2026-11-05 21:17:53 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: usb: chipidea: ci_hdrc_imx: fix usbmisc handling usbmisc is an optional device property so it is totally valid for the corresponding data->usbmisc_data to have a NULL value. Check that before dereferencing the pointer. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool.

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-476

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 3f46fefab962fc5dcfe4d53a7c2cdccd51ebdc6d 8060b719676e8c0e5a2222c2977ba0458d9d9535 git Not specified
CNA Linux Linux affected 7ae96eba35036bdd47ecd956e882ff057a550405 0ee460498ced49196149197c9f6d29a10e5e0798 git Not specified
CNA Linux Linux affected dcd4de31bd01a7189c24e3cafe40649c9c42b9af 121e9f80ea5478bca3a8f3f26593fd66f87da649 git Not specified
CNA Linux Linux affected 57797497a696cffaea421fc4e5a3ea2a8536b1a2 887902ca73490f38c69fd6149ef361a041cf912f git Not specified
CNA Linux Linux affected 74adad500346fb07d69af2c79acbff4adb061134 2aa87bd825377f5073b76701780a902cd0fc725a git Not specified
CNA Linux Linux affected 74adad500346fb07d69af2c79acbff4adb061134 4e28f79e3dffa52d327b46d1a78dac16efb5810b git Not specified
CNA Linux Linux affected 5.15.179 5.15.181 semver Not specified
CNA Linux Linux affected 6.1.129 6.1.136 semver Not specified
CNA Linux Linux affected 6.6.72 6.6.89 semver Not specified
CNA Linux Linux affected 6.12.10 6.12.26 semver Not specified
CNA Linux Linux affected 6.13 Not specified
CNA Linux Linux unaffected 6.13 semver Not specified
CNA Linux Linux unaffected 5.15.181 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.136 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.89 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.26 6.12.* semver Not specified
CNA Linux Linux unaffected 6.14.5 6.14.* semver Not specified
CNA Linux Linux unaffected 6.15 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/887902ca73490f38c69fd6149ef361a041cf912f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/8060b719676e8c0e5a2222c2977ba0458d9d9535 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/121e9f80ea5478bca3a8f3f26593fd66f87da649 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/4e28f79e3dffa52d327b46d1a78dac16efb5810b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/2aa87bd825377f5073b76701780a902cd0fc725a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/05/msg00045.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
git.kernel.org/stable/c/0ee460498ced49196149197c9f6d29a10e5e0798 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report