CVE-2025-37917 is a vulnerability identified in the Linux kernel specifically within the MediaTek Star EMAC (Ethernet MAC) driver, known as mtk-star-emac. The issue arises from improper handling of spinlocks during the receive (rx) and transmit (tx) polling operations. The driver uses spin_lock and spin_unlock primitives where spin_lock_irqsave and spin_unlock_irqrestore should be used. This improper locking mechanism can lead to spinlock recursion, a condition where the same CPU attempts to acquire a spinlock it already holds, causing a kernel BUG and potential system instability or crash. The problem manifests when DMA interrupts are re-enabled during rx/tx polling, triggering recursive locking attempts that the kernel detects and flags as a critical error. The provided kernel stack trace illustrates the failure occurring on CPU0 in the swapper process, highlighting the recursive lock acquisition in the mtk_star_handle_irq function and subsequent interrupt handling routines. This vulnerability is rooted in concurrency control within the kernel's network driver code and affects Linux kernel versions containing the vulnerable mtk-star-emac driver implementation. While no known exploits are reported in the wild, the flaw can cause denial of service (DoS) by crashing or halting the kernel, impacting system availability. The fix involves replacing spin_lock and spin_unlock calls with their irqsave/irqrestore variants to properly manage interrupt states and prevent recursion. This vulnerability is particularly relevant for systems running Linux on MediaTek MT8365 or similar platforms using the affected driver. Given that the Linux kernel is widely deployed across servers, embedded devices, and network infrastructure, this flaw could impact a range of devices using the MediaTek Ethernet controller. However, exploitation requires triggering specific interrupt and polling conditions, and no authentication or user interaction is needed to cause the kernel panic once the vulnerable driver is active.

For European organizations, the primary impact of CVE-2025-37917 is a potential denial of service due to kernel crashes on affected Linux systems running MediaTek-based Ethernet hardware. This can disrupt network connectivity and availability of critical services, especially in embedded systems, IoT devices, or network appliances that rely on the mtk-star-emac driver. Enterprises using Linux-based infrastructure with MediaTek Ethernet controllers in routers, gateways, or specialized hardware may experience unexpected downtime or degraded network performance. While the vulnerability does not directly expose confidentiality or integrity risks, the loss of availability can affect business continuity, particularly in sectors dependent on stable network operations such as telecommunications, manufacturing automation, and critical infrastructure. The absence of known exploits reduces immediate risk, but unpatched systems remain vulnerable to accidental or maliciously induced kernel panics. European organizations with supply chains or hardware vendors utilizing MediaTek platforms should prioritize assessing their exposure. The impact is more pronounced in environments where high availability is critical and where embedded Linux devices form part of the operational technology or network edge.

1. Apply the official Linux kernel patches that replace spin_lock/spin_unlock with spin_lock_irqsave/spin_unlock_irqrestore in the mtk-star-emac driver as soon as they are released and integrated into distributions. 2. Identify and inventory all Linux systems using MediaTek MT8365 or similar hardware with the vulnerable Ethernet driver to prioritize patch deployment. 3. For embedded or IoT devices where kernel updates are challenging, coordinate with hardware vendors or device manufacturers to obtain updated firmware or kernel images containing the fix. 4. Implement monitoring for kernel panics or unexpected reboots on affected devices to detect potential exploitation or accidental triggering of the vulnerability. 5. Where possible, isolate vulnerable devices from critical network segments to limit impact if a DoS occurs. 6. Engage with Linux distribution maintainers and hardware vendors to ensure timely communication and patch availability. 7. Consider deploying kernel live patching solutions if supported by the environment to reduce downtime during patch application. 8. Conduct thorough testing of patched kernels in staging environments to confirm stability before production rollout, especially for embedded systems.