CVE-2025-37935

What it actually does

Race condition in mtk_poll_rx() causes incorrect high-word SDP refill on 4GB+ RFB descriptors when MTK_RESETTING is set, leading mtk_rx_clean to process invalid pointers and trigger kernel panic.

Why it matters to the business

Unexpected system crashes and reboots on affected Ubuntu 20.04 AWS instances using MediaTek Ethernet, resulting in service disruption and potential data loss until the kernel is updated.

How an attack unfolds

An attacker or workload triggers concurrent RX polling and device reset on a 4GB+ RAM system; the flawed flag check allows descriptor corruption that panics the kernel during cleanup.

How to fix it

Upgrade linux-aws-5.15 on Ubuntu 20.04 LTS to version 5.15.0-1073.79~20.04.1 or later; apply the MediaTek SDK patch if building custom kernels.

How to confirm the fix worked

Confirm kernel version is at or above the fixed release; test RX traffic with device resets on systems with 4GB+ RAM to ensure no panic occurs.

Typical attack path

1. Gain local execution or trigger network activity on affected MediaTek SoC hardware
2. Force or wait for MTK_RESETTING flag during mtk_poll_rx() execution
3. Observe kernel panic from invalid SDP processing in mtk_rx_clean

How to detect it

Search kernel logs for panic traces mentioning mtk_poll_rx, MTK_RESETTING, or mtk_rx_clean; correlate with network reset events on MediaTek Ethernet devices.

What your security team should do

• Prioritize kernel package upgrade on all linux-aws-5.15 Ubuntu 20.04 instances within the next maintenance window
• Monitor for kernel panics referencing mtk_eth_soc or mtk_poll_rx in system logs
• Restrict untrusted local access on affected systems until patched