CVE-2025-37977 (GCVE-0-2025-37977)
Vulnerability from cvelistv5
Published
2025-05-20 16:58
Modified
2026-08-05 11:58
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set If dma-coherent property isn't set then descriptors are non-cacheable and the iocc shareability bits should be disabled. Without this UFS can end up in an incompatible configuration and suffer from random cache related stability issues.
References
Impacted products
Vendor Product Version
Linux Linux Version: cc52e15397cc5dc773d3c6792b98352d3209f93f
Version: cc52e15397cc5dc773d3c6792b98352d3209f93f
Version: cc52e15397cc5dc773d3c6792b98352d3209f93f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/host/ufs-exynos.c",
            "drivers/ufs/host/ufs-exynos.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "869749e48115ef944eeabec8e84138908471fa51",
              "status": "affected",
              "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f",
              "versionType": "git"
            },
            {
              "lessThan": "f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51",
              "status": "affected",
              "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f",
              "versionType": "git"
            },
            {
              "lessThan": "f92bb7436802f8eb7ee72dc911a33c8897fde366",
              "status": "affected",
              "version": "cc52e15397cc5dc773d3c6792b98352d3209f93f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/host/ufs-exynos.c",
            "drivers/ufs/host/ufs-exynos.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.26",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.4",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: exynos: Disable iocc if dma-coherent property isn\u0027t set\n\nIf dma-coherent property isn\u0027t set then descriptors are non-cacheable\nand the iocc shareability bits should be disabled. Without this UFS can\nend up in an incompatible configuration and suffer from random cache\nrelated stability issues."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is an Exynos UFS host controller driver path programmed at probe time and exercised by ordinary block/filesystem I/O to the local storage device. There is no network-facing consumer, so reaching it requires local access to issue I/O.\nAC:L - The coherency configuration is systematically wrong on every transfer on affected platforms \u2014 not a narrow race the attacker must win \u2014 and a local process can reliably drive sustained UFS I/O plus cache pressure to surface the incoherency. No precondition lies outside the attacker\u0027s influence.\nPR:L - Any unprivileged local process can generate the UFS traffic that flows through the mismatched descriptor rings and streaming DMA mappings via normal file reads and writes. No capability or root access is needed.\nUI:N - The broken shareability programming is applied at driver probe and takes effect on all subsequent I/O; no victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - The incoherent DMA is confined to buffers the kernel itself mapped for the UFS controller, so the impact stays within the kernel/OS security authority. It is a cache shareability attribute mismatch, not an IOMMU or DMA-boundary bypass.\nC:H - With DMA_FROM_DEVICE the post-transfer invalidate can discard the device-written line, leaving the CPU to read the physical page\u0027s prior contents \u2014 previously freed kernel or other-process memory \u2014 and return it to userspace as file data. The driver likewise consumes stale device-written response UPIU and sense data from non-cacheable descriptor memory.\nI:H - Device writes can be dropped and stale cache contents flushed to the storage device, corrupting file data and filesystem metadata on the primary boot medium, and the driver acts on stale descriptor/status fields it believes the controller wrote.\nA:H - The commit explicitly cites random cache-related stability issues; incoherent UTRD/UTMRD rings lead to misparsed completions, I/O timeouts, controller resets, hangs and kernel crashes on the root storage device."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:43.660Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/869749e48115ef944eeabec8e84138908471fa51"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51"
        },
        {
          "url": "https://git.kernel.org/stable/c/f92bb7436802f8eb7ee72dc911a33c8897fde366"
        }
      ],
      "title": "scsi: ufs: exynos: Disable iocc if dma-coherent property isn\u0027t set",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37977",
    "datePublished": "2025-05-20T16:58:20.693Z",
    "dateReserved": "2025-04-16T04:51:23.975Z",
    "dateUpdated": "2026-08-05T11:58:43.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.