Listen to this Post
How the mentioned CVE works:
The vulnerability CVE-2025-37970 exists within the `st_lsm6dsx` Inertial Measurement Unit (IMU) driver of the Linux kernel. The flaw is located in the `st_lsm6dsx_read_fifo` function responsible for reading data from the device’s hardware FIFO (First-In, First-Out) buffer. A critical error occurs when the driver’s internal `pattern_len` variable is zero while the physical device’s FIFO reports it is not empty. This inconsistent state causes the function’s main read loop to enter an infinite cycle. The loop continues to attempt reading data based on a zero-length pattern, failing to consume any actual FIFO entries. Consequently, the kernel thread executing this driver code becomes permanently stuck, unable to exit the function. This constitutes a classic lockup condition at the kernel level. The hung thread cannot service other system requests or be terminated normally. Depending on which kernel thread is affected and the system configuration, this can lead to a partial system freeze or a complete denial-of-service. The vulnerability is triggered by specific, malformed data sequences or timing issues during FIFO operations on the ST LSM6DSx sensor chip. Exploitation does not require elevated privileges; any user or process that can access the IMU device node may trigger the condition. The locked-up kernel thread consumes CPU resources indefinitely, starving other processes. Recovery typically requires a hard system reboot, as the kernel cannot gracefully recover from the infinite loop in its driver subsystem.
Platform: Linux Kernel
Version: Affected versions
Vulnerability: Infinite Loop
Severity: Critical
date: 2025-05-20
Prediction: 2025-06-10
What Undercode Say:
Analytics
Check if the vulnerable module is loaded lsmod | grep st_lsm6dsx Check current kernel version uname -r Search kernel log for driver messages dmesg | grep -i lsm6dsx
How Exploit:
An attacker with local user access can trigger the flaw by performing a read operation on the vulnerable IMU device node (e.g., /dev/iio:deviceX) when the hardware FIFO is in a specific state. This causes the kernel thread servicing the read to enter an infinite loop, leading to a denial-of-service (DoS) condition for the entire system or a core CPU.
Protection from this CVE
Apply the official kernel patch that adds a check for zero `pattern_len` before entering the FIFO read loop. Update to a Linux kernel version where the commit fixing this issue is backported. Disable the `st_lsm6dsx` kernel module if not required.
Impact:
System lockup, forced reboot, denial-of-service, CPU resource exhaustion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
