CVE-2025-37970

iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo

MEDIUM

5.5

CVSS Score

Published: May 20, 2025 at 04:47 PM UTC

Updated: June 17, 2026 at 09:15 AM UTC

2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Linux Kernel · Linux

95%

4.11 ≤ v < 5.10.2384.11 ≤ v < 5.15.1834.11 ≤ v < 5.4.2944.11 ≤ v < 6.1.1394.11 ≤ v < 6.12.294.11 ≤ v < 6.14.74.11 ≤ v < 6.154.11 ≤ v < 6.6.915.11 ≤ v < 5.15.1835.16 ≤ v < 6.1.1395.5 ≤ v < 5.10.2386.13 ≤ v < 6.14.76.2 ≤ v < 6.6.916.7 ≤ v < 6.12.29290a6ce11d938be52634b3ce1bbc6b78be4d23c14.11 6.15 rc1 6.15 rc2 6.15 rc3 6.15 rc4 6.15 rc5

Vendor states this is fixed in 159ca7f18129834b6f4c7eae67de48e96c752fc9 (fixed)

Vendor states this is fixed in 3bb6c02d6fe8347ce1785016d135ff539c20043c (fixed)

Vendor states this is fixed in 6c4a5000618a8c44200d455c92e2f2a4db264717 (fixed)

Vendor states this is fixed in 84e39f628a3a3333add99076e4d6c8b42b12d3a0 (fixed)

Vendor states this is fixed in a1cad8a3bca41dead9980615d35efc7bff1fd534 (fixed)

Vendor states this is fixed in da33c4167b9cc1266a97215114cb74679f881d0c (fixed)

Vendor states this is fixed in f06a1a1954527cc4ed086d926c81ff236b2adde9 (fixed)

Vendor states this is fixed in f3cf233c946531a92fe651ff2bd15ebbe60630a7 (fixed)

Vendor states this is fixed in 4.11 (unaffected)

Vendor states this is fixed in 5.10.238 (unaffected)

Vendor states this is fixed in 5.15.183 (unaffected)

Vendor states this is fixed in 5.4.294 (unaffected)