High 7.1Published May 8, 2025

CVE-2025-37800driver core: fix potential NULL pointer dereference in dev_uevent()

Updated under an hour ago (Oct 27, 2026, 1:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential NULL pointer dereference in dev_uevent() If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it. Use WRITE_ONCE() when setting the driver pointer to ensure there is no tearing.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 16574dccd8f62dc1b585325f8a6a0aab10047ed8 before abe56be73eb10a677d16066f65ff9d30251f5eee; 16574dccd8f62dc1b585325f8a6a0aab10047ed8 builds before 2b344e779d9afd0fcb5ee4000e4d0fc7d8d867eb; 16574dccd8f62dc1b585325f8a6a0aab10047ed8 builds before 3781e4b83e174364998855de777e184cf0b62c40; 16574dccd8f62dc1b585325f8a6a0aab10047ed8 builds before 18daa52418e7e4629ed1703b64777294209d2622	CNA record
linux linux_kernel linux:linux_kernel	before 6.6.89; from 6.7 before 6.12.26; from 6.13 before 6.14.5; 6.15; 6.15; 6.15	NVD

References

References

https://git.kernel.org/stable/c/abe56be73eb10a677d16066f65ff9d30251f5eee	patch
https://git.kernel.org/stable/c/2b344e779d9afd0fcb5ee4000e4d0fc7d8d867eb	patch
https://git.kernel.org/stable/c/3781e4b83e174364998855de777e184cf0b62c40	patch
https://git.kernel.org/stable/c/18daa52418e7e4629ed1703b64777294209d2622	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.