Concurrency Issue in ASUS WMI Driver within Linux Kernel

CVE-2025-39837

What is CVE-2025-39837?

A concurrency vulnerability exists in the ASUS WMI driver within the Linux kernel, caused by the simultaneous execution of asus_wmi_register_driver() from multiple drivers. This leads to race conditions during the registration process, which can result in memory corruption and system instability. The issue is compounded by inadequate error handling, particularly the failure to unregister ACPI lps0 device operations during error scenarios. A recent patch has addressed these vulnerabilities by implementing necessary mutexes at the registration points and refining the error handling procedures to ensure system robustness.

References