CVE-2025-37877
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
09/05/2025
Last modified:
12/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
iommu: Clear iommu-dma ops on cleanup<br />
<br />
If iommu_device_register() encounters an error, it can end up tearing<br />
down already-configured groups and default domains, however this<br />
currently still leaves devices hooked up to iommu-dma (and even<br />
historically the behaviour in this area was at best inconsistent across<br />
architectures/drivers...) Although in the case that an IOMMU is present<br />
whose driver has failed to probe, users cannot necessarily expect DMA to<br />
work anyway, it&#39;s still arguable that we should do our best to put<br />
things back as if the IOMMU driver was never there at all, and certainly<br />
the potential for crashing in iommu-dma itself is undesirable. Make sure<br />
we clean up the dev->dma_iommu flag along with everything else.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.12.26 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.14.5 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



