Critical Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-38328: In the Linux kernel, the following vulnerability has been resolved: jffs2: check jffs2_prealloc_raw_node_refs() result in few other places Fuzzing hit another invalid pointer dereference due to the lack of checking wheth... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used in various distributions, including Debian. This vulnerability affects multiple versions of the Linux kernel in Debian 11, 12, and 13, highlighting the importance of maintaining kernel security to prevent potential exploitation.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the JFFS2 file system. Specifically, the issue arises from the lack of proper error handling in the jffs2_prealloc_raw_node_refs() function, leading to a potential null pointer dereference. This flaw could allow an attacker to exploit the system, causing crashes or unauthorized access to sensitive data. The vulnerability was discovered through fuzzing techniques, which revealed that the code did not adequately check the success of memory allocation, resulting in undefined behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the necessary updates as soon as they become available.
Conclusion
The CVE-2025-38328 vulnerability in the Linux kernel poses significant risks to systems running Debian. It is essential for users to stay informed about updates and apply patches promptly to safeguard their systems against potential exploitation. Utilizing tools like Vulert can help monitor vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38328 is a critical vulnerability in the Linux kernel related to the JFFS2 file system, which can lead to null pointer dereferences and potential system crashes.
Debian versions 11, 12, and 13 are affected by this vulnerability, with specific patches available for Debian 13.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to prioritize updating your kernel as soon as possible to mitigate the risk of exploitation.
The vulnerability was discovered by the Linux Verification Center using fuzzing techniques, which revealed a lack of error handling in the kernel code.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
