Critical Overflow Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-38257: In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by u... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing system resources and hardware communication. It provides essential services for all other software running on the system. The kernel is modular, allowing for various functionalities and optimizations. However, it is also susceptible to vulnerabilities, which can lead to severe security risks if not addressed promptly.
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2025-38257 has been discovered in the s390/pkey subsystem. This issue arises from an overflow in the size calculation for the memdup_user() function, which is influenced by user input through an ioctl call. If the size calculation overflows, it can lead to a mismatch between the allocated memory size and the expected size, resulting in unpredictable behavior and potential system crashes or security breaches. The vulnerability was found by the Linux Verification Center.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate any risks associated with this issue.
Conclusion
The CVE-2025-38257 vulnerability in the Linux kernel poses a significant risk to Debian systems. It is essential for users to stay informed about this issue and apply the necessary updates to protect their systems from potential exploitation.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38257 is a vulnerability in the Linux kernel that can lead to memory overflow issues, potentially causing unpredictable behavior in the system.
If exploited, this vulnerability can lead to system crashes, data corruption, or unauthorized access, posing significant security risks.
Debian versions 11, 12, and 13 are affected by this vulnerability. It is crucial to check for updates and apply patches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
