CVE-2025-37990

What it actually does

Missing return-value check on brcmf_usb_dl_cmd() inside brcmf_usb_dl_writeimage() leaves state.state and state.bytes uninitialized, resulting in use of uninitialized memory in subsequent conditional logic and potential kernel memory corruption.

Why it matters to the business

Kernel-level memory corruption on affected Ubuntu AWS instances can cause system instability, crashes, or privilege-escalation opportunities; although EPSS remains low and the issue is not catalogued in CISA KEV, widespread use of the linux-aws-5.15 package means broad exposure across cloud workloads.

How an attack unfolds

An attacker supplies a USB device or triggers conditions that cause brcmf_usb_dl_cmd() to fail during firmware download; because the caller does not check the return value, subsequent code operates on uninitialized state fields, allowing crafted input to corrupt kernel memory and potentially escalate privileges, consistent with patterns seen in related Linux kernel privilege-escalation campaigns.

How to fix it

Upgrade linux-aws-5.15 on Ubuntu 20.04 LTS to version 5.15.0-1072.78~20.04.1 or later; after package installation, reboot the instance to load the corrected kernel.

How to confirm the fix worked

Verify the running kernel reports version 5.15.0-1072.78~20.04.1 or newer with 'uname -r'; confirm the brcmfmac module loads without the original unhandled-path code via source or binary diff against the fixed package.

Typical attack path

1. Gain local or physical access sufficient to interact with the Broadcom USB Wi-Fi device
2. Force brcmf_usb_dl_cmd() to return failure (e.g., malformed USB responses)
3. Trigger execution of the uninitialized state.state / state.bytes checks
4. Leverage resulting memory corruption to corrupt kernel structures
5. Escalate to ring-0 code execution or container escape

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for brcmf_usb_dl_cmd failure messages or subsequent use of uninitialized values; correlate with USB device insertion events around the time of any crash or anomalous behavior.

What your security team should do

• Immediately schedule patching of all linux-aws-5.15 instances to 5.15.0-1072.78~20.04.1
• Prioritize workloads with USB Wi-Fi or Broadcom chipset exposure
• Monitor kernel logs for brcmf_usb_dl_cmd related errors as an interim indicator
• Reassess after 30-day EPSS trend review for any increase in exploit maturity