LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37882: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we are handling the event, a new TD may be queued at this ring position. I can trigger this race by rising interrupt moderation to increase IRQ handling delay. Similar delay may occur naturally due to system load. If this ever happens after a Missed Service Error, missed TDs will be skipped and the new TD processed as if it matched the event. It could be given back prematurely, risking data loss or buffer UAF by the xHC. Don't complete TDs on xrun events and don't warn if queued TDs don't match the event's TRB pointer, which can be NULL or a link/no-op TRB. Don't warn if there are no queued TDs at all. Now that it's safe, also handle xrun events if the skip flag is clear. This ensures completion of any TD stuck in 'error mid TD' state right before the xrun event, which could happen if a driver submits a finite number of URBs to a buggy HC and then an error occurs on the last TD.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race in Linux xHCI USB handling can confuse an old error event with newly queued work. Under timing delays or system load, USB data may complete prematurely, risking data loss or access to a freed buffer. This could compromise system confidentiality, integrity, or availability, although the sources do not establish code execution.

Executive priority

Prioritize systems combining affected kernels, xHCI hardware, isochronous USB workloads, and untrusted local access. Expedite updates on sensitive or high-availability endpoints because the stated impact spans confidentiality, integrity, and availability. Exact exposure requires vendor confirmation due to incomplete version metadata.

Technical view

Isochronous ring underrun or overrun events may carry a stale, NULL, link, or no-op TRB pointer. After a missed-service error, delayed handling can associate the event with a newly queued transfer descriptor, causing premature completion and possible controller DMA into freed memory. The stable fix avoids completing descriptors on these events and safely handles relevant error states.

Likely exposure

Linux systems using xHCI USB host controllers and isochronous transfers are the relevant population. The bundle flags versions 6.10, 6.12.26, 6.14.5, and 6.15, but also contains an anomalous "0" entry and no CPEs. Confirm exact distribution and backport status through vendor guidance.

Exploitation context

CVSS describes a local, low-complexity attack requiring low privileges and no user interaction. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The race was reproducible by increasing interrupt-handling delay, which can also occur naturally under load.

Researcher notes

The reported flaw is a timing-dependent event-to-transfer association race, not a documented generic USB parsing bug. Interrupt moderation can enlarge the race window, while ordinary system load may produce similar delay. No CWE, CPE, public exploit, or confirmed exploitation evidence is supplied. The three referenced stable commits should be used to assess backports.

Mitigation direction

  • Apply a vendor-supported kernel update incorporating the applicable Linux stable fix.
  • Reboot into the updated kernel and confirm it is running.
  • Follow distribution guidance because vendors may backport fixes without changing upstream-style version numbers.
  • Until updated, restrict untrusted local access and unnecessary USB device attachment where operationally feasible.

Validation and detection

  • Inventory Linux systems using xHCI controllers and isochronous USB workloads.
  • Compare each running kernel with vendor advisories and the referenced stable commits.
  • Confirm the remediated kernel is active after reboot, not merely installed.
  • Review kernel logs for xHCI missed-service, underrun, overrun, or memory-safety symptoms.
  • Test relevant USB workloads in staging for stability and data integrity after updating.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37882 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-37882Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux608b973b70f87e9a9bafbfdfa16aab68507aef45, 608b973b70f87e9a9bafbfdfa16aab68507aef45, 608b973b70f87e9a9bafbfdfa16aab68507aef45unaffected
LinuxLinux6.10, 0, 6.12.26, 6.14.5, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.