Deadlock Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-37884: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock between rcu_tasks_trace and event_mutex. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various distributions, including Debian. This vulnerability specifically affects the event handling mechanisms within the kernel, which are crucial for performance monitoring and tracing.
Vulnerability Detail
In the Linux kernel, a deadlock vulnerability has been identified between the RCU (Read-Copy-Update) tasks trace and the event mutex. This issue arises when the function _free_event() attempts to acquire the event_mutex while simultaneously calling synchronize_rcu_tasks_trace(). This can lead to a situation where two CPUs are waiting on each other, causing a system hang. The vulnerability can be exploited in scenarios where performance monitoring tools are used, potentially leading to system instability and degraded performance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can delegate the trace_set_clr_event() function to a workqueue to avoid the lock dependency that leads to the deadlock. This can be implemented in the kernel code, but it is advisable to apply the official patch as soon as it is available.
Conclusion
The CVE-2025-37884 vulnerability in the Linux kernel poses a significant risk of deadlock, affecting various Debian packages. It is crucial for users to update their systems to the latest patched version to ensure stability and performance. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37884 is a vulnerability in the Linux kernel that can cause a deadlock between RCU tasks trace and event mutex, potentially leading to system instability.
You can use Vulert, which monitors open-source vulnerabilities in real-time using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected.
The vulnerability can lead to system hangs and degraded performance, especially in environments using performance monitoring tools.
Yes, a patch has been released for the affected versions of the Linux kernel. It is recommended to update to the latest version to mitigate the risk.
If you cannot apply the patch immediately, consider implementing the suggested workaround by delegating the trace_set_clr_event() function to a workqueue.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
