---
id: CVE-2025-37907
title: 'accel/ivpu: Fix locking order in ivpu_job_submit'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  accel/ivpu: Fix locking order in ivpu_job_submit

  Fix deadlock in job submission and abort handling.
  When a thread aborts currently executing jobs due to a fault,
  it fi…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 35b137630f08d913fc2e33df33ccc2570dff3f7d <
    079d2622f8c9e0c380149645fff21d35c59ce6ff
  - >-
    Linux >= 35b137630f08d913fc2e33df33ccc2570dff3f7d <
    b9b70924a272c2d72023306bc56f521c056212ee
  - >-
    Linux >= 35b137630f08d913fc2e33df33ccc2570dff3f7d <
    ab680dc6c78aa035e944ecc8c48a1caab9f39924
  - Linux 6.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:44:52.390927Z'
published: '2025-05-20'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:52:07.508Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-37907'
references:
  - url: 'https://git.kernel.org/stable/c/079d2622f8c9e0c380149645fff21d35c59ce6ff'
  - url: 'https://git.kernel.org/stable/c/b9b70924a272c2d72023306bc56f521c056212ee'
  - url: 'https://git.kernel.org/stable/c/ab680dc6c78aa035e944ecc8c48a1caab9f39924'
tags:
  - cve.org
epss: 0.00152
epssPercentile: 0.04392
ingestedAt: '2026-11-05T22:38:31.892Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Fix locking order in ivpu_job_submit

Fix deadlock in job submission and abort handling.
When a thread aborts currently executing jobs due to a fault,
it first locks the global lock protecting submitted_jobs (#1).

After the last job is destroyed, it proceeds to release the related context
and locks file_priv (#2). Meanwhile, in the job submission thread,
the file_priv lock (#2) is taken first, and then the submitted_jobs
lock (#1) is obtained when a job is added to the submitted jobs list.

       CPU0                            CPU1
       ----                    	       ----
  (for example due to a fault)         (jobs submissions keep coming)

  lock(&vdev->submitted_jobs_lock) #1
  ivpu_jobs_abort_all()
  job_destroy()
                                      lock(&file_priv->lock)           #2
                                      lock(&vdev->submitted_jobs_lock) #1
  file_priv_release()
  lock(&vdev->context_list_lock)
  lock(&file_priv->lock)           #2

This order of locking causes a deadlock. To resolve this issue,
change the order of locking in ivpu_job_submit().

## Affected

- `Linux >= 35b137630f08d913fc2e33df33ccc2570dff3f7d < 079d2622f8c9e0c380149645fff21d35c59ce6ff`
- `Linux >= 35b137630f08d913fc2e33df33ccc2570dff3f7d < b9b70924a272c2d72023306bc56f521c056212ee`
- `Linux >= 35b137630f08d913fc2e33df33ccc2570dff3f7d < ab680dc6c78aa035e944ecc8c48a1caab9f39924`
- `Linux 6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.