Security readout for executives and security teams
Plain-English summary
A locking flaw in the Linux MediaTek STAR Ethernet driver can cause the kernel to encounter recursive spinlock handling during network receive or transmit processing. The resulting failure may hang or crash an affected device, disrupting network-dependent services. The supplied CVSS score is 7.5 and identifies availability, not data theft or modification, as the impact.
Executive priority
Prioritize remediation for exposed appliances, embedded systems, and operational devices whose availability depends on the affected Ethernet interface. General-purpose Linux systems without this driver are unlikely to be exposed. Expedite vendor-supported updates where an outage would affect production, safety, communications, or remote management.
Technical view
During mtk-star-emac RX or TX polling, DMA interrupts can be re-enabled while a driver spinlock is held. The interrupt handler may then attempt to acquire the same lock, causing spinlock recursion. Linux resolved this by replacing spin_lock/spin_unlock with interrupt-state-preserving spin_lock_irqsave/spin_unlock_irqrestore. The supplied vector is network-accessible, low-complexity, unauthenticated, and availability-only.
Likely exposure
Exposure is limited to Linux systems using the affected MediaTek mtk-star-emac Ethernet driver, rather than all Linux hosts. The trace identifies a MediaTek MT8365 development platform, but the bundle does not establish that this is the only affected hardware. Downstream kernel backports make version-only assessment unreliable.
Exploitation context
The supplied data does not mark this CVE as KEV and provides no evidence of active exploitation or a public exploit. Its CVSS vector indicates network reachability without privileges or user interaction, but the bundle does not document a proven triggering technique. Treat remote denial of service as plausible, not confirmed in the wild.
Researcher notes
The diagnostic trace shows recursion between mtk_star_rx_poll and mtk_star_handle_irq on a preemptible 6.15 release-candidate kernel. Six stable-tree commits are supplied, indicating branch-specific backports. The affected-version data contains duplicated hashes and ambiguous version entries, so validate downstream packages through vendor advisories or patch presence rather than interpreting the list as clean ranges.
Mitigation direction
- Inventory Linux devices using the MediaTek mtk-star-emac Ethernet driver.
- Update affected devices to a vendor-supported kernel containing the applicable stable fix.
- Follow distribution and device-vendor advisories for downstream backports and release-specific remediation.
- Reboot after updating and verify the patched kernel is running.
Validation and detection
- Confirm whether mtk-star-emac is present, loaded, and bound to active Ethernet hardware.
- Compare the running kernel package against vendor advisories and the listed stable commits.
- Review kernel logs for spinlock recursion, mtk_star_emac traces, hangs, or watchdog resets.
- Test RX and TX traffic under normal load after patching, watching for kernel faults.
Public sources used
- CVE Program record for CVE-2025-37917
- CVE List V5 record
- Linux stable commit bedd287fdd3142dffad7ae2ac6ef15f4a2ad0629
- Linux stable commit 94107259f972d2fd896dbbcaa176b3b2451ff9e5
- Linux stable commit 7cb10f17bddc415f30fbc00a4e2b490e0d94c462
- Linux stable commit 8d40bf73fa7f31eac2b0a7c9d85de67df82ee7f3
- Linux stable commit d886f8d85494d12b2752fd7c6c32162d982d5dd5
- Linux stable commit 6fe0866014486736cc3ba1c6fd4606d3dbe55c9c
- Debian LTS announcement
- Siemens ProductCERT advisory SSA-019113
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37917 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/bedd287fdd3142dffad7ae2ac6ef15f4a2ad0629CVE reference, Linux
- https://git.kernel.org/stable/c/94107259f972d2fd896dbbcaa176b3b2451ff9e5CVE reference, Linux
- https://git.kernel.org/stable/c/7cb10f17bddc415f30fbc00a4e2b490e0d94c462CVE reference, Linux
- https://git.kernel.org/stable/c/8d40bf73fa7f31eac2b0a7c9d85de67df82ee7f3CVE reference, Linux
- https://git.kernel.org/stable/c/d886f8d85494d12b2752fd7c6c32162d982d5dd5CVE reference, Linux
- https://git.kernel.org/stable/c/6fe0866014486736cc3ba1c6fd4606d3dbe55c9cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.