Skip to content
Fencer Vulns
high 7.8

CVE-2025-37882 json

usb: xhci: Fix isochronous Ring Underrun/Overrun event handling

published 2025-05-09 18 mo ago modified 2026-10-15 24 d ago also EUVD-2025-14108

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix isochronous Ring Underrun/Overrun event handling

The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we are handling the event, a new TD may be queued at this ring position.

I can trigger this race by rising interrupt moderation to increase IRQ handling delay. Similar delay may occur naturally due to system load.

If this ever happens after a Missed Service Error, missed TDs will be skipped and the new TD processed as if it matched the event. It could be given back prematurely, risking data loss or buffer UAF by the xHC.

Don't complete TDs on xrun events and don't warn if queued TDs don't match the event's TRB pointer, which can be NULL or a link/no-op TRB. Don't warn if there are no queued TDs at all.

Now that it's safe, also handle xrun events if the skip flag is clear. This ensures completion of any TD stuck in 'error mid TD' state right before the xrun event, which could happen if a driver submits a finite number of URBs to a buggy HC and then an error occurs on the last TD.

Patch / fix

  • Linux Linux 6.12.26, 6.14.5, 6.15
  • linux Debian 14, Debian 13 6.12.27-1

debian advisories DEBIAN-CVE-2025-37882

  • linux-gcp-6.14 Ubuntu 24.04 LTS 6.14.0-1011.11~24.04.1
  • linux-realtime-6.14 Ubuntu Pro Realtime 24.04 LTS 6.14.0-1010.10~24.04.1

ubuntu advisories UBUNTU-CVE-2025-37882

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-rt RHEL 9.0 E4S 5.14.0-70.169.1.rt21.241.el9_0
  • kernel-rt-kvm RHEL 9.0 E4S 5.14.0-70.169.1.rt21.241.el9_0
  • kernel-rt-core RHEL 9.0 E4S 5.14.0-70.169.1.rt21.241.el9_0
  • kernel-rt-modules RHEL 9.0 E4S 5.14.0-70.169.1.rt21.241.el9_0
  • kernel-rt-debug-kvm RHEL 9.0 E4S 5.14.0-70.169.1.rt21.241.el9_0
  • kernel-rt-debug-core RHEL 9.0 E4S 5.14.0-70.169.1.rt21.241.el9_0
  • kernel-rt-debug-modules RHEL 9.0 E4S 5.14.0-70.169.1.rt21.241.el9_0
  • kernel-rt-modules-extra RHEL 9.0 E4S 5.14.0-70.169.1.rt21.241.el9_0

red hat advisories RHSA-2026:4244RHSA-2026:4245RHSA-2026:3579RHSA-2026:3358RHSA-2026:3267RHSA-2026:2766

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-37882 updated cvss 6.0

kernel: Linux kernel: xHCI driver isochronous event handling race condition leading to data loss or UAF

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    affected: no fix available
  • Red Hat Enterprise Linux 10 kernel
    affected: no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder EUS (v.9.4) libperf 5.14.0-427.111.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.111.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.111.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.111.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.111.1.el9_4
    fixed: vendor fix RHSA-2026:2766
  • Red Hat CodeReady Linux Builder EUS (v.9.6) libperf 5.14.0-570.89.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.89.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.89.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.89.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.89.1.el9_6
    fixed: vendor fix RHSA-2026:2759
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) perf 5.14.0-70.169.1.el9_0, kernel-devel-matched 5.14.0-70.169.1.el9_0, kernel-debug-devel-matched 5.14.0-70.169.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.169.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.169.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.169.1.el9_0, +2 more
    fixed: vendor fix RHSA-2026:4245
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perf 5.14.0-284.158.1.el9_2, rtla 5.14.0-284.158.1.el9_2, kernel-devel-matched 5.14.0-284.158.1.el9_2, kernel-64k-devel-matched 5.14.0-284.158.1.el9_2, kernel-debug-devel-matched 5.14.0-284.158.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.158.1.el9_2, +5 more
    fixed: vendor fix RHSA-2026:3267
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rv 6.12.0-55.62.1.el10_0, perf 6.12.0-55.62.1.el10_0, rtla 6.12.0-55.62.1.el10_0, python3-perf 6.12.0-55.62.1.el10_0, kernel-devel-matched 6.12.0-55.62.1.el10_0, kernel-64k-devel-matched 6.12.0-55.62.1.el10_0, +7 more
    fixed: vendor fix RHSA-2026:3579
show 17 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) rv 5.14.0-427.111.1.el9_4, perf 5.14.0-427.111.1.el9_4, rtla 5.14.0-427.111.1.el9_4, kernel-devel-matched 5.14.0-427.111.1.el9_4, kernel-64k-devel-matched 5.14.0-427.111.1.el9_4, kernel-debug-devel-matched 5.14.0-427.111.1.el9_4, +6 more
    fixed: vendor fix RHSA-2026:2766
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) rv 5.14.0-570.89.1.el9_6, perf 5.14.0-570.89.1.el9_6, rtla 5.14.0-570.89.1.el9_6, python3-perf 5.14.0-570.89.1.el9_6, kernel-devel-matched 5.14.0-570.89.1.el9_6, kernel-64k-devel-matched 5.14.0-570.89.1.el9_6, +7 more
    fixed: vendor fix RHSA-2026:2759
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) kernel 5.14.0-70.169.1.el9_0, bpftool 5.14.0-70.169.1.el9_0, kernel-core 5.14.0-70.169.1.el9_0, kernel-tools 5.14.0-70.169.1.el9_0, python3-perf 5.14.0-70.169.1.el9_0, kernel-modules 5.14.0-70.169.1.el9_0, +14 more
    fixed: vendor fix RHSA-2026:4245
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool 7.0.0-284.158.1.el9_2, kernel 5.14.0-284.158.1.el9_2, kernel-64k 5.14.0-284.158.1.el9_2, kernel-core 5.14.0-284.158.1.el9_2, kernel-tools 5.14.0-284.158.1.el9_2, python3-perf 5.14.0-284.158.1.el9_2, +28 more
    fixed: vendor fix RHSA-2026:3267
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel 6.12.0-55.62.1.el10_0, kernel-64k 6.12.0-55.62.1.el10_0, kernel-core 6.12.0-55.62.1.el10_0, kernel-tools 6.12.0-55.62.1.el10_0, kernel-modules 6.12.0-55.62.1.el10_0, kernel-64k-core 6.12.0-55.62.1.el10_0, +27 more
    fixed: vendor fix RHSA-2026:3579
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool 7.3.0-427.111.1.el9_4, kernel 5.14.0-427.111.1.el9_4, kernel-64k 5.14.0-427.111.1.el9_4, kernel-core 5.14.0-427.111.1.el9_4, kernel-tools 5.14.0-427.111.1.el9_4, python3-perf 5.14.0-427.111.1.el9_4, +28 more
    fixed: vendor fix RHSA-2026:2766
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel 5.14.0-570.89.1.el9_6, kernel-64k 5.14.0-570.89.1.el9_6, kernel-core 5.14.0-570.89.1.el9_6, kernel-tools 5.14.0-570.89.1.el9_6, kernel-modules 5.14.0-570.89.1.el9_6, kernel-64k-core 5.14.0-570.89.1.el9_6, +27 more
    fixed: vendor fix RHSA-2026:2759
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libperf 6.12.0-55.62.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.62.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.62.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.62.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.62.1.el10_0
    fixed: vendor fix RHSA-2026:3579
  • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-kvm 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-core 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-modules 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-debug-kvm 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-debug-core 5.14.0-70.169.1.rt21.241.el9_0, +4 more Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-core 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-modules 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-debug-core 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-debug-modules 5.14.0-70.169.1.rt21.241.el9_0, kernel-rt-modules-extra 5.14.0-70.169.1.rt21.241.el9_0, +2 more
    fixed: vendor fix RHSA-2026:4244
  • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-core 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-modules 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-debug-core 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-modules-core 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-debug-modules 5.14.0-284.158.1.rt14.443.el9_2, +4 more
    fixed: vendor fix RHSA-2026:3358
  • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt 6.12.0-55.62.1.el10_0, kernel-rt-64k 6.12.0-55.62.1.el10_0, kernel-rt-core 6.12.0-55.62.1.el10_0, kernel-rt-modules 6.12.0-55.62.1.el10_0, kernel-rt-64k-core 6.12.0-55.62.1.el10_0, kernel-rt-debug-core 6.12.0-55.62.1.el10_0, +14 more
    fixed: vendor fix RHSA-2026:3579
  • Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt 5.14.0-427.111.1.el9_4, kernel-rt-core 5.14.0-427.111.1.el9_4, kernel-rt-modules 5.14.0-427.111.1.el9_4, kernel-rt-debug-core 5.14.0-427.111.1.el9_4, kernel-rt-modules-core 5.14.0-427.111.1.el9_4, kernel-rt-debug-modules 5.14.0-427.111.1.el9_4, +4 more
    fixed: vendor fix RHSA-2026:2766
  • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt 5.14.0-570.89.1.el9_6, kernel-rt-64k 5.14.0-570.89.1.el9_6, kernel-rt-core 5.14.0-570.89.1.el9_6, kernel-rt-modules 5.14.0-570.89.1.el9_6, kernel-rt-64k-core 5.14.0-570.89.1.el9_6, kernel-rt-debug-core 5.14.0-570.89.1.el9_6, +14 more
    fixed: vendor fix RHSA-2026:2759
  • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-kvm 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-core 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-modules 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-debug-kvm 5.14.0-284.158.1.rt14.443.el9_2, kernel-rt-debug-core 5.14.0-284.158.1.rt14.443.el9_2, +6 more
    fixed: vendor fix RHSA-2026:3358
  • Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt 6.12.0-55.62.1.el10_0, kernel-rt-kvm 6.12.0-55.62.1.el10_0, kernel-rt-core 6.12.0-55.62.1.el10_0, kernel-rt-modules 6.12.0-55.62.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.62.1.el10_0, kernel-rt-debug-core 6.12.0-55.62.1.el10_0, +6 more
    fixed: vendor fix RHSA-2026:3579
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt 5.14.0-427.111.1.el9_4, kernel-rt-kvm 5.14.0-427.111.1.el9_4, kernel-rt-core 5.14.0-427.111.1.el9_4, kernel-rt-modules 5.14.0-427.111.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.111.1.el9_4, kernel-rt-debug-core 5.14.0-427.111.1.el9_4, +6 more
    fixed: vendor fix RHSA-2026:2766
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt 5.14.0-570.89.1.el9_6, kernel-rt-kvm 5.14.0-570.89.1.el9_6, kernel-rt-core 5.14.0-570.89.1.el9_6, kernel-rt-modules 5.14.0-570.89.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.89.1.el9_6, kernel-rt-debug-core 5.14.0-570.89.1.el9_6, +6 more
    fixed: vendor fix RHSA-2026:2759

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
24 d ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.