CVE-2025-37935
The vulnerability is a critical flaw in the Linux kernel's mtk_eth_soc Ethernet driver that can cause a system panic when handling packets on systems with 4GB or more RAM. It occurs when the MTK_RESETTING flag is detected, leading to incorrect processing of network descriptors. The issue has been resolved by applying a patch from MediaTek's SDK.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel systems using the mtk_eth_soc driver, particularly those with 4GB or more RAM.
Real-world impact
An attacker could trigger a denial‑of‑service condition by causing the kernel to panic, potentially crashing the system.
Why this severity
The CVSS v3.1 base score is 9.8 (Critical) due to network‑adjacent attack vector, low attack complexity, no privileges or user interaction required, and high impacts to confidentiality, integrity, and availability.
What to do about it
- 01Apply the MediaTek SDK patch to the mtk_eth_soc driver as described in the kernel fix.
NVD-referenced vendor advisory
Timeline
- May 20, 2025 · May 20, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.