What is CVE-2025-37940?

CVE-2025-37940 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, classified as a Improper Locking flaw (CWE-667), affecting Linux kernel versions from 4.11 onward and patched in 5.4.293, 5.10.237, 5.15.181 and others. CVE-2025-37940 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2025-37940?

CVE-2025-37940 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2025-37940?

Yes, CVE-2025-37940 has been patched. Fixed versions include 5.4.293, 5.10.237, 5.15.181 and others. If you are running Linux kernel 4.11 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2025-37940 actively exploited?

CVE-2025-37940 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Improper Locking (CWE-667)?

The product does not properly acquire or release a lock, which can lead to unexpected behaviour. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/667.html

CVE-2025-37940

Medium

In the Linux kernel, the following vulnerability has been resolved: ftrace: Add cond_resched() to ftrace_graph_set_hash() When the kernel contains a large number of functions that can be traced, the loop in ftrace_graph_set_hash() may take a lot of time to execute. This may trigger the softlockup watchdog. Add cond_resched() within the loop to allow the kernel to remain responsive even when processing a large number of functions. This matches the cond_resched() that is used in other locations of the code that iterates over all functions that can be traced.

Package Linux Kernel

Published 2025-05-20

Last modified 2025-12-19

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness type

CWE-667

CVE-2025-37940 is a Improper Locking vulnerability

What is Improper Locking?

The product does not properly acquire or release a lock, which can lead to unexpected behaviour. Learn more on MITRE CWE

Affected versions

Linux kernel versions 4.11 and later are affected. Fixed in 5.4.293, 5.10.237, 5.15.181, 6.1.135, 6.6.88, 6.12.24, 6.13.12, 6.14.3, 6.15 and their respective stable series.

Affected from

≥ 4.11

Fixed in

✓ 5.4.293 5.4.x ✓ 5.10.237 5.10.x ✓ 5.15.181 5.15.x ✓ 6.1.135 6.1.x ✓ 6.6.88 6.6.x ✓ 6.12.24 6.12.x ✓ 6.13.12 6.13.x ✓ 6.14.3 6.14.x ✓ 6.15

References

10 total

Kernel Git
https://git.kernel.org/stable/c/1fce9574b9d515bcb8a75379a8053e18602424e3

Patch
Kernel Git
https://git.kernel.org/stable/c/42ea22e754ba4f2b86f8760ca27f6f71da2d982c

Patch
Kernel Git
https://git.kernel.org/stable/c/4429535acab750d963fdc3dfcc9e0eee42f4d599

Patch
Kernel Git
https://git.kernel.org/stable/c/5d336ac215e5c76e43ef4bca9ba699835e53e2fd

Patch
Kernel Git
https://git.kernel.org/stable/c/618655d54c5f8af5d57b77491d08c0f0ff77d114

Patch

Showing 5 of 10 references View all on NVD

Details

CVE ID CVE-2025-37940

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2025-05-20

Modified 2025-12-19

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2025-37940?

CVE-2025-37940 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 , classified as an Improper Locking flaw (CWE-667) . It affects Linux kernel versions from 4.11 onward and has been patched in 5.4.293, 5.10.237, 5.15.181 and others. CVE-2025-37940 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2025-37940?

CVE-2025-37940 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2025-37940?

Yes. CVE-2025-37940 has been patched. Fixed versions include 5.4.293, 5.10.237, 5.15.181 and others. If you are running Linux kernel 4.11 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2025-37940 actively exploited?

No. CVE-2025-37940 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.