CVE-2025-37907 (GCVE-0-2025-37907)
Vulnerability from cvelistv5
Published
2025-05-20 15:21
Modified
2025-05-26 05:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix locking order in ivpu_job_submit Fix deadlock in job submission and abort handling. When a thread aborts currently executing jobs due to a fault, it first locks the global lock protecting submitted_jobs (#1). After the last job is destroyed, it proceeds to release the related context and locks file_priv (#2). Meanwhile, in the job submission thread, the file_priv lock (#2) is taken first, and then the submitted_jobs lock (#1) is obtained when a job is added to the submitted jobs list. CPU0 CPU1 ---- ---- (for example due to a fault) (jobs submissions keep coming) lock(&vdev->submitted_jobs_lock) #1 ivpu_jobs_abort_all() job_destroy() lock(&file_priv->lock) #2 lock(&vdev->submitted_jobs_lock) #1 file_priv_release() lock(&vdev->context_list_lock) lock(&file_priv->lock) #2 This order of locking causes a deadlock. To resolve this issue, change the order of locking in ivpu_job_submit().
References
Impacted products
Vendor Product Version
Linux Linux Version: 35b137630f08d913fc2e33df33ccc2570dff3f7d
Version: 35b137630f08d913fc2e33df33ccc2570dff3f7d
Version: 35b137630f08d913fc2e33df33ccc2570dff3f7d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ivpu/ivpu_job.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "079d2622f8c9e0c380149645fff21d35c59ce6ff",
              "status": "affected",
              "version": "35b137630f08d913fc2e33df33ccc2570dff3f7d",
              "versionType": "git"
            },
            {
              "lessThan": "b9b70924a272c2d72023306bc56f521c056212ee",
              "status": "affected",
              "version": "35b137630f08d913fc2e33df33ccc2570dff3f7d",
              "versionType": "git"
            },
            {
              "lessThan": "ab680dc6c78aa035e944ecc8c48a1caab9f39924",
              "status": "affected",
              "version": "35b137630f08d913fc2e33df33ccc2570dff3f7d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/ivpu/ivpu_job.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Fix locking order in ivpu_job_submit\n\nFix deadlock in job submission and abort handling.\nWhen a thread aborts currently executing jobs due to a fault,\nit first locks the global lock protecting submitted_jobs (#1).\n\nAfter the last job is destroyed, it proceeds to release the related context\nand locks file_priv (#2). Meanwhile, in the job submission thread,\nthe file_priv lock (#2) is taken first, and then the submitted_jobs\nlock (#1) is obtained when a job is added to the submitted jobs list.\n\n       CPU0                            CPU1\n       ----                    \t       ----\n  (for example due to a fault)         (jobs submissions keep coming)\n\n  lock(\u0026vdev-\u003esubmitted_jobs_lock) #1\n  ivpu_jobs_abort_all()\n  job_destroy()\n                                      lock(\u0026file_priv-\u003elock)           #2\n                                      lock(\u0026vdev-\u003esubmitted_jobs_lock) #1\n  file_priv_release()\n  lock(\u0026vdev-\u003econtext_list_lock)\n  lock(\u0026file_priv-\u003elock)           #2\n\nThis order of locking causes a deadlock. To resolve this issue,\nchange the order of locking in ivpu_job_submit()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T05:23:27.446Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/079d2622f8c9e0c380149645fff21d35c59ce6ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9b70924a272c2d72023306bc56f521c056212ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab680dc6c78aa035e944ecc8c48a1caab9f39924"
        }
      ],
      "title": "accel/ivpu: Fix locking order in ivpu_job_submit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37907",
    "datePublished": "2025-05-20T15:21:40.482Z",
    "dateReserved": "2025-04-16T04:51:23.966Z",
    "dateUpdated": "2025-05-26T05:23:27.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37907\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:27.177\",\"lastModified\":\"2025-05-21T20:25:16.407\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naccel/ivpu: Fix locking order in ivpu_job_submit\\n\\nFix deadlock in job submission and abort handling.\\nWhen a thread aborts currently executing jobs due to a fault,\\nit first locks the global lock protecting submitted_jobs (#1).\\n\\nAfter the last job is destroyed, it proceeds to release the related context\\nand locks file_priv (#2). Meanwhile, in the job submission thread,\\nthe file_priv lock (#2) is taken first, and then the submitted_jobs\\nlock (#1) is obtained when a job is added to the submitted jobs list.\\n\\n       CPU0                            CPU1\\n       ----                    \\t       ----\\n  (for example due to a fault)         (jobs submissions keep coming)\\n\\n  lock(\u0026vdev-\u003esubmitted_jobs_lock) #1\\n  ivpu_jobs_abort_all()\\n  job_destroy()\\n                                      lock(\u0026file_priv-\u003elock)           #2\\n                                      lock(\u0026vdev-\u003esubmitted_jobs_lock) #1\\n  file_priv_release()\\n  lock(\u0026vdev-\u003econtext_list_lock)\\n  lock(\u0026file_priv-\u003elock)           #2\\n\\nThis order of locking causes a deadlock. To resolve this issue,\\nchange the order of locking in ivpu_job_submit().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: accel/ivpu: Se corrige el orden de bloqueo en ivpu_job_submit. Se corrige el bloqueo en el env\u00edo de trabajos y la gesti\u00f3n de abortos. Cuando un hilo cancela trabajos en ejecuci\u00f3n debido a un fallo, primero bloquea el bloqueo global que protege submit_jobs (#1). Tras la destrucci\u00f3n del \u00faltimo trabajo, libera el contexto relacionado y bloquea file_priv (#2). Mientras tanto, en el hilo de env\u00edo de trabajos, primero se obtiene el bloqueo file_priv (#2) y, a continuaci\u00f3n, el bloqueo submit_jobs (#1) al a\u00f1adir un trabajo a la lista de trabajos enviados. CPU0 CPU1 ---- ---- (por ejemplo, debido a un fallo) (los env\u00edos de trabajos siguen llegando) lock(\u0026amp;vdev-\u0026gt;submitted_jobs_lock) #1 ivpu_jobs_abort_all() job_destroy() lock(\u0026amp;file_priv-\u0026gt;lock) #2 lock(\u0026amp;vdev-\u0026gt;submitted_jobs_lock) #1 file_priv_release() lock(\u0026amp;vdev-\u0026gt;context_list_lock) lock(\u0026amp;file_priv-\u0026gt;lock) #2 Este orden de bloqueo provoca un interbloqueo. Para solucionar este problema, cambie el orden de bloqueo en ivpu_job_submit().\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/079d2622f8c9e0c380149645fff21d35c59ce6ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ab680dc6c78aa035e944ecc8c48a1caab9f39924\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b9b70924a272c2d72023306bc56f521c056212ee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.