Listen to this Post
How the mentioned CVE works
The vulnerability exists within the `st_lsm6dsx` inertial measurement unit (IMU) driver of the Linux kernel. The specific flawed function is st_lsm6dsx_read_tagged_fifo, which is responsible for reading data from the sensor’s hardware FIFO (First-In-First-Out) buffer. A logic error occurs when a variable called `pattern_len` is equal to zero while the physical device FIFO still contains data. Under this condition, the function’s control flow enters an infinite loop, as it lacks a proper termination check. This constitutes an improper locking issue (CWE-667), where the software does not properly synchronize or handle shared resource access, leading to a system lockup. The loop consumes kernel CPU resources indefinitely, rendering the affected core or system unresponsive and causing a local denial-of-service (DoS). Exploitation requires local access with low privileges (PR:L).
DailyCVE Form
Platform: Linux Kernel
Version: With st_lsm6dsx driver
Vulnerability: Infinite Loop DoS
Severity: Medium
Date: 2025-05-20
Prediction: 2025-06-20
What Undercode Say
Analytics
`uname -r`
`cat /sys/bus/iio/devices/iio:device0/name`
`sudo zypper patches –cve=CVE-2025-37969`
`sudo apt list –installed | grep linux-image`
`sudo yum update kernel`
How Exploit
Local access required
Low privileges needed
Trigger malicious FIFO state
Causes kernel lockup
Denial of service result
Protection from this CVE
Apply kernel updates
Patch versions: 6.4.0-150600.23.53.1
Patch versions: 6.4.0-150700.53.6.1
Update SL-Micro: 6.4.0-30.1
Impact
System availability loss
No integrity impact
No confidentiality impact
High availability impact
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
