CVE-2025-37970

What it actually does

The st_lsm6dsx_read_fifo function can enter an infinite loop when pattern_len equals zero while the device FIFO still contains data, resulting in a kernel-level denial of service.

Why it matters to the business

Systems using affected Linux kernels with the st_lsm6dsx IMU driver may experience sudden hangs or require reboots, disrupting operations on devices that rely on this sensor; the low EPSS and absence from KEV indicate limited observed exploitation but still warrant prompt attention for embedded and IoT deployments.

How an attack unfolds

An attacker with the ability to influence the sensor FIFO state or pattern_len value (for example via crafted device interaction in a privileged context) can trigger the loop condition, causing the kernel thread handling FIFO reads to spin indefinitely; listed threat actors associated with other Linux kernel privilege-escalation CVEs may combine this with additional flaws for enhanced denial-of-service effects.

How to fix it

Update the Linux kernel to a version that includes commit f06a1a1954527cc4ed086d926c81ff236b2adde9 in the stable tree; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit f06a1a1954527cc4ed086d926c81ff236b2adde9 by inspecting the git log or kernel version string; test FIFO read paths under zero-length pattern conditions to verify loop prevention.

Typical attack path

1. Gain local or physical access to a system containing the st_lsm6dsx sensor
2. Manipulate conditions so that pattern_len becomes zero while FIFO data remains
3. Trigger repeated FIFO read operations to enter the infinite loop
4. Observe resulting kernel hang or unresponsive system

How to detect it

Inspect kernel logs and dmesg output for repeated entries or stalls around st_lsm6dsx_read_fifo; correlate with process hangs in sensor-handling threads and monitor for unexpected system unresponsiveness on affected hardware.

What your security team should do

• Apply the referenced kernel commit immediately on all systems using the st_lsm6dsx driver
• Prioritize patching for embedded, automotive, and IoT devices where sensor lockups have high operational impact
• Monitor for related Linux kernel privilege-escalation activity from the listed threat actors
• Review sensor driver usage and consider disabling unused IIO devices until patched