Kernel Module Kobject Safety Vulnerability in Linux Packages
Summary
CVE-2025-37995: In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's modular architecture allows for dynamic loading and unloading of modules, which enhances flexibility but also introduces potential vulnerabilities. This specific vulnerability affects the handling of kobjects in modules, which are essential for managing kernel objects safely.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the function 'lookup_or_create_module_kobject()' where an internal kobject is created using 'module_ktype'. If an error occurs, calling 'kobject_put()' leads to an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. This can result in unsafe memory access, potentially leading to system instability or crashes. The vulnerability arises from insufficient checks during error handling, making it critical to ensure that 'kobject_put()' is safe under all circumstances.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate risks.
Conclusion
The CVE-2025-37995 vulnerability in the Linux kernel poses a significant risk due to improper handling of kobjects in module types. Users are advised to update their systems to the patched version to ensure safety and stability. Regular monitoring and prompt updates are essential to mitigate such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37995 is a vulnerability in the Linux kernel related to the handling of kobjects in module types, which can lead to unsafe memory access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Kobjects are kernel objects that provide a way to manage and represent kernel resources, facilitating communication and resource management within the kernel.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and apply the patch as soon as possible.
Detailed information about CVE-2025-37995 can be found in the official CVE database and through security advisories from your Linux distribution.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
