CVE-2025-37842: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remove function will be called first during device detach and trigger kernel panic. Drop the remove function and use devm_add_action_or_reset() for driver cleanup to ensure the release sequence. Trigger kernel panic on i.MX8MQ by echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind

Affected products

• Linux Linux Kernel: from 5.2, before 6.6.105 (fixed in 6.6.105); from 6.7, before 6.12.36 (fixed in 6.12.36); from 6.13, before 6.13.12 (fixed in 6.13.12); from 6.14, before 6.14.3 (fixed in 6.14.3)

Published 2025-05-09. Last modified 2026-06-17.