Critical Memory Management Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-37852: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() Add error handling to propagate amdgpu_cgs_create_device() failures to th... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various distributions, including Debian. This vulnerability specifically impacts the amdgpu driver, which is responsible for managing AMD graphics cards. The vulnerability arises from inadequate error handling in the amdgpu_cgs_create_device() function, which can lead to null pointer dereferences, potentially causing system crashes or instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the amdgpu driver where the function amdgpu_cgs_create_device() does not handle errors properly. When this function fails, it does not propagate the error to the caller, leading to a situation where the hardware manager (hwmgr) is not released correctly. This oversight can result in a null pointer dereference, causing system crashes or unexpected behavior. The vulnerability was introduced in version 0 and has been fixed in later versions, specifically changing the error code from -EINVAL to -ENOMEM to ensure proper memory management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, ensuring that your system is updated to the latest version of the Linux kernel is the best practice to mitigate potential risks.
Conclusion
The CVE-2025-37852 vulnerability in the Linux kernel's amdgpu driver poses a significant risk due to improper error handling, leading to potential system crashes. It is crucial for users to update their systems to the latest patched versions to ensure security and stability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37852 is a vulnerability in the Linux kernel's amdgpu driver that can lead to null pointer dereferences due to improper error handling.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to access the code.
If exploited, this vulnerability can lead to system crashes or instability, affecting the overall performance of the operating system.
Yes, patches are available for Debian 12 and 13. Ensure you update to the specified versions to mitigate the vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without signing up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
