CVE-2025-37968

What it actually does

Race condition in opt3001 driver threaded IRQ handler reads a flag at mutex_lock time and again at unlock time; when the flag state flips between the two reads the mutex remains held, producing a permanent deadlock.

Why it matters to the business

Affected Linux systems using the OPT3001 sensor experience sudden unresponsiveness or kernel hangs that require reboot, interrupting workloads on a wide range of older Ubuntu server and cloud images.

How an attack unfolds

A local user triggers repeated sensor interrupts while simultaneously exercising paths that alter the internal flag; the resulting inconsistent flag values between the two mutex operations leave the lock held, freezing the affected thread and any dependent processes.

How to fix it

Upgrade the linux, linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oracle and related packages to the exact fixed versions listed for each Ubuntu release (e.g., linux 5.4.0-9.12 on 20.04 LTS, 4.15.0-16.19 on 18.04 LTS, 4.4.0-2.16 on 16.04 LTS). Reboot after package installation.

How to confirm the fix worked

Verify the running kernel version matches or exceeds the fixed package version for the distribution; confirm the opt3001 driver no longer contains the double flag read pattern in opt3001_irq().

Typical attack path

1. Obtain local shell on a system running an affected kernel with the opt3001 driver loaded
2. Generate concurrent sensor interrupts and flag-modifying operations
3. Trigger the window where the flag is true on lock but false on unlock
4. Cause mutex to remain held, resulting in deadlock and system hang

How to detect it

Review kernel logs for repeated opt3001 IRQ entries without corresponding completion, watch for processes stuck in uninterruptible sleep inside the driver, and correlate with sensor activity spikes; no public exploit artifacts are known.

What your security team should do

• Immediately patch all listed Ubuntu 14.04–20.04 LTS variants to the supplied fixed versions
• Prioritize systems that expose the OPT3001 sensor or run sensor-heavy workloads
• Reboot and monitor for recurrence of IRQ-related hangs after upgrade
• Remove or blacklist the opt3001 module on systems that do not require the sensor until patches are applied