CVE-2025-37810

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: dwc3: gadget: check that event count does not exceed event buffer length<br /> <br /> The event count is read from register DWC3_GEVNTCOUNT.<br /> There is a check for the count being zero, but not for exceeding the<br /> event buffer length.<br /> Check that event count does not exceed event buffer length,<br /> avoiding an out-of-bounds access when memcpy&amp;#39;ing the event.<br /> Crash log:<br /> Unable to handle kernel paging request at virtual address ffffffc0129be000<br /> pc : __memcpy+0x114/0x180<br /> lr : dwc3_check_event_buf+0xec/0x348<br /> x3 : 0000000000000030 x2 : 000000000000dfc4<br /> x1 : ffffffc0129be000 x0 : ffffff87aad60080<br /> Call trace:<br /> __memcpy+0x114/0x180<br /> dwc3_interrupt+0x24/0x34