Security readout for executives and security teams
Plain-English summary
A Linux kernel defect can crash certain Qualcomm-based systems when software configures an interrupt on a GPIO that cannot wake the device. Successful triggering requires local access and low privileges according to the supplied CVSS vector. The demonstrated consequence is a kernel crash, creating availability and operational risk for affected embedded, robotics, mobile, or appliance deployments.
Executive priority
Prioritize exposed Qualcomm-based production devices where local users, applications, or services can manipulate GPIOs. Accelerate remediation for safety-sensitive, high-availability, or remotely administered appliances. Broader Linux fleets should first confirm hardware and driver applicability. There is no supplied evidence of active exploitation, so urgency should be driven by exposure and outage consequences.
Technical view
The Qualcomm MPM interrupt driver failed to remove non-wake GPIOs, marked GPIO_NO_WAKE_IRQ, from the IRQ hierarchy. Interrupt setup could consequently reach mpm_set_type with an invalid mapping and cause a kernel paging fault. The correction applies the existing qcom-pdc-style check and disconnects MPM from the hierarchy. The supplied evidence demonstrates a crash, not data theft or modification.
Likely exposure
Exposure is limited to Linux systems using affected Qualcomm chipsets, the qcom-mpm driver, and non-wake-capable GPIO interrupt handling. Systems without that hardware or driver path are unlikely to be exposed. The supplied version data is ambiguous, so distribution kernel advisories and backport status should determine applicability rather than version strings alone.
Exploitation context
The CVSS 3.1 vector is local, low-complexity, low-privilege, and requires no user interaction. The bundle includes a reproducible crash trace, but no evidence of active exploitation; the CVE is not listed as KEV. Although CVSS assigns high confidentiality, integrity, and availability impacts, the supplied technical description only substantiates a kernel crash.
Researcher notes
The vulnerable path concerns IRQ-domain hierarchy handling for GPIO_NO_WAKE_IRQ pins. Referenced Linux stable commits implement the correction across maintained branches. The flattened affected-version list does not clearly express introduced and fixed boundaries; validate exact branch and distributor backport status. Assess privilege boundaries around GPIO character devices, but treat the provided crash as the only demonstrated impact.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix or backport.
- Confirm remediation guidance and fixed package versions with the Linux distribution or device vendor.
- Until patched, restrict untrusted local access to GPIO interfaces on potentially affected systems.
- Avoid configuring interrupts for known non-wake GPIOs where operationally feasible.
Validation and detection
- Inventory Qualcomm-based devices and identify kernels loading or compiling the qcom-mpm driver.
- Compare kernel packages and vendor backports against the referenced stable commits.
- Determine whether local users or services can access GPIO interfaces on affected devices.
- Review kernel logs for paging faults involving mpm_set_type or qcom_mpm_set_type.
- Do not reproduce the trigger on production systems because it may crash the kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37901 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/45aced97f01d5ab14c8a2a60f6748f18c501c3f5CVE reference, Linux
- https://git.kernel.org/stable/c/dfbaecf7e38f5e9bfa5e47a1e525ffbb58bab8cfCVE reference, Linux
- https://git.kernel.org/stable/c/f102342360950b56959e5fff4a874ea88ae13758CVE reference, Linux
- https://git.kernel.org/stable/c/d5c10448f411a925dd59005785cb971f0626e032CVE reference, Linux
- https://git.kernel.org/stable/c/38a05c0b87833f5b188ae43b428b1f792df2b384CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.