Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can destabilize affected Exynos-based systems using UFS storage. When a required device-tree property is absent, the driver may enable incompatible cache-sharing behavior, causing unpredictable cache-related failures. The supplied CVSS score is 7.8, reflecting potentially serious confidentiality, integrity, and availability impact under a local attack model.
Executive priority
Treat as a high-priority platform update for confirmed Exynos UFS deployments, especially systems exposed to untrusted local users. Broader Linux fleets are not automatically affected. First establish hardware and configuration applicability, then apply the vendor-supported corrected kernel through normal change controls.
Technical view
The Exynos UFS driver fails to disable IOCC shareability bits when the dma-coherent property is unset. In that configuration, descriptors are non-cacheable, so enabled shareability can create an incompatible cache configuration and random stability problems. The cited kernel changes correct the behavior by disabling IOCC for the non-coherent case.
Likely exposure
Exposure appears limited to Linux systems using the Exynos UFS driver where dma-coherent is absent. The bundle identifies affected releases including 5.16, 6.12.26, 6.14.4, and 6.15, but its version data is ambiguous. Confirm applicability against the running kernel, hardware, device tree, and vendor advisory.
Exploitation context
The supplied CVSS vector describes local access, low complexity, low privileges, and no user interaction. However, the sources provide no exploit narrative or confirmed attack path. The CVE is not listed as KEV in the bundle, so there is no supplied evidence of active exploitation.
Researcher notes
The supplied record describes random stability issues, while CVSS claims high confidentiality, integrity, and availability impact. The bundle does not explain how cache instability produces those security outcomes. No CWE, proof of concept, or exploitation evidence is provided. Researchers should distinguish affected driver configuration from generic Linux version matching.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable cited stable fix.
- Check Linux or device-vendor guidance for the corrected release appropriate to the deployed hardware.
- Prioritize affected multi-user or otherwise locally accessible systems.
- Monitor unstable UFS behavior until remediation is completed.
Validation and detection
- Inventory Exynos-based systems using the Linux UFS Exynos driver.
- Record running kernel versions and compare them with vendor applicability guidance.
- Inspect device-tree configuration to determine whether dma-coherent is absent.
- Verify the installed kernel includes the applicable cited correction.
- After updating, monitor storage and kernel logs for recurring UFS or cache-related instability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37977 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/869749e48115ef944eeabec8e84138908471fa51CVE reference, Linux
- https://git.kernel.org/stable/c/f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51CVE reference, Linux
- https://git.kernel.org/stable/c/f92bb7436802f8eb7ee72dc911a33c8897fde366CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.