CVE-2025-37985

What it actually does

Race condition in the Linux kernel USB wdm driver between wdm_open and wdm_wwan_port_stop where clearing WDM_WWAN_IN_USE is not the final action, allowing a chardev to be opened with still-poisoned URBs.

Why it matters to the business

Potential kernel memory corruption or privilege escalation on affected Ubuntu Linux systems across many LTS releases; high ecosystem prevalence in cloud and server environments increases exposure for organizations running legacy kernels.

How an attack unfolds

An attacker triggers the race window during WWAN port stop and concurrent device open to obtain a handle to a device whose URBs remain poisoned, enabling subsequent use-after-free or memory manipulation attacks, potentially leveraged by advanced spyware campaigns or chained with other Linux kernel privilege-escalation flaws.

How to fix it

Upgrade to the following fixed package versions: linux 3.11.0-12.19 (14.04), 4.4.0-2.16 (16.04), 4.13.0-16.19 (18.04), 5.4.0-9.12 (20.04); linux-aws 4.4.0-1002.2 (14.04), 4.4.0-1001.10 (16.04), 4.15.0-1001.1 (18.04), 5.4.0-1005.5 (20.04); and equivalent updates for linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oracle, and linux-hwe-edge as listed in the CVE advisory.

How to confirm the fix worked

Verify running kernel package versions match or exceed the listed fixed releases; confirm absence of the race by reviewing wdm.c source for WDM_WWAN_IN_USE clearing as the final step before return; re-test WWAN attach/detach sequences under load.

Typical attack path

1. Identify a system with the vulnerable wdm driver and an active WWAN interface
2. Trigger wdm_wwan_port_stop while concurrently invoking wdm_open from userspace
3. Exploit the window where WDM_WWAN_IN_USE is cleared before URB poisoning is complete
4. Obtain a file descriptor to the poisoned chardev and perform follow-on memory corruption or privilege-escalation primitives

How to detect it

Review kernel logs for wdm driver warnings or oops messages around WWAN port stop events; correlate with unusual chardev open attempts on /dev/ttyUSB* or /dev/cdc-wdm* devices; inspect for post-exploit artifacts from listed advanced spyware campaigns or chained kernel exploits.

What your security team should do

• Prioritize immediate kernel upgrades on all affected Ubuntu 14.04/16.04/18.04/20.04 systems given 526 days since publication
• Restrict unprivileged access to WWAN and USB character devices until patches are applied
• Monitor for related Linux kernel privilege-escalation chains listed among threat actors
• Schedule staged rollouts starting with internet-facing and cloud instances