Critical TOCTOU Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-38112: In the Linux kernel, the following vulnerability has been resolved: net: Fix TOCTOU issue in sk_is_readable() sk->sk_prot->sock_is_readable is a valid function pointer when sk resides in a sockmap. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various distributions, including Debian. This vulnerability specifically affects the socket management functionality within the kernel, which is crucial for network communication. The issue arises from a race condition that can lead to a null pointer dereference, potentially causing system instability or crashes.
Vulnerability Detail
In the Linux kernel, a Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the sk_is_readable() function. This issue occurs when the socket's protocol structure (sk->sk_prot) is modified after an initial check, leading to a scenario where the function pointer sock_is_readable can become NULL. If this happens, subsequent calls to sk_is_readable() may result in a null pointer dereference, which can crash the application or the kernel itself. This vulnerability affects multiple Debian versions, including Debian 11, 12, and 13.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel as mentioned above.
Conclusion
The TOCTOU vulnerability in the Linux kernel poses a significant risk to systems running Debian. It is essential to stay informed about such vulnerabilities and apply necessary updates promptly to ensure system stability and security. Utilizing tools like Vulert can help in monitoring for vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
A TOCTOU (Time-of-Check to Time-of-Use) vulnerability occurs when a system checks a condition and then uses the result of that check later, allowing for a change in state that can lead to unintended consequences.
This vulnerability can lead to a null pointer dereference, which may cause applications or the entire system to crash, leading to potential data loss or service disruption.
If you are using Debian 11, 12, or 13 with the Linux kernel, your system may be affected. It is advisable to check for updates and apply them promptly.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
While there are no specific workarounds available, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
