Critical Divide-by-Zero Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-39742: In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the d... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing system resources and hardware interactions. It provides essential services and functionalities, enabling software applications to communicate with hardware components. The kernel is crucial for system stability and performance, and vulnerabilities within it can lead to severe security risks, including system crashes and unauthorized access.
Vulnerability Detail
The vulnerability identified as CVE-2025-39742 arises from a divide-by-zero error in the RDMA (Remote Direct Memory Access) subsystem of the Linux kernel. Specifically, the function 'find_hw_thread_mask()' divides the number of online CPUs by 'num_core_siblings' without adequately checking if 'num_core_siblings' is zero. This oversight can lead to a runtime error, potentially causing system instability or crashes. The vulnerability is critical as it can be exploited in environments where RDMA is utilized, affecting performance and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate any risks associated with the divide-by-zero error.
Conclusion
The CVE-2025-39742 vulnerability in the Linux kernel poses significant risks to Debian systems, particularly those utilizing RDMA. It is crucial to apply the necessary updates to mitigate potential impacts. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39742 is a vulnerability in the Linux kernel that can lead to a divide-by-zero error, potentially causing system crashes.
Debian 11, 12, 13, and 14 are affected by this vulnerability, with specific patched versions available for Debian 13 and 14.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to install any software.
Failing to address this vulnerability may lead to system instability, crashes, and potential exploitation by malicious actors, especially in environments utilizing RDMA.
To apply the patch, update your Linux package to the latest version using the commands: 'sudo apt update' followed by 'sudo apt upgrade linux'.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
