Critical Division by Zero Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-39681: In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot")... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, the kernel is susceptible to vulnerabilities that can compromise system integrity and performance. This specific vulnerability affects multiple Debian versions (11, 12, 13, and 14) and is linked to the Hygon architecture, which did not implement a necessary function in its boot process.
Vulnerability Detail
In the Linux kernel, a critical vulnerability has been identified due to the omission of the resctrl_cpu_detect() function in the Hygon BSP initialization code. This oversight leads to a division by zero fault during the early boot stage on machines that support X86_FEATURE_CQM*. The issue arises when the get_rdt_mon_resources() function attempts to calculate mon_l3_config using an uninitialized variable, resulting in system crashes and potential data loss.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is released.
Conclusion
The CVE-2025-39681 vulnerability poses a significant risk to systems running affected versions of the Linux kernel on Debian. It is essential for users to update their systems promptly to avoid potential crashes and data loss. Utilizing tools like Vulert can help in monitoring vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39681 is a vulnerability in the Linux kernel that causes a division by zero fault during the boot process on certain Hygon systems.
This vulnerability can lead to system crashes during the boot process, potentially resulting in data loss and system instability.
Yes, Debian versions 11, 12, 13, and 14 are all affected by this vulnerability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
