CVE-2025-37993 is a medium-severity vulnerability in the Linux kernel's CAN bus driver (m_can), affecting the linux and linux_kernel products. It stems from an uninitialized spin lock (tx_handling_spinlock), leading to kernel panics and system unavailability when CAN frames are sent. The vulnerability has a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity, requiring low privileges, and resulting in high availability impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion or media coverage, suggesting a low immediate threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.9, < 6.12.29CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.13, < 6.14.7CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:* | ||
6.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:* | ||
6.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.