Critical UAF Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-21693: In the Linux kernel, the following vulnerability has been resolved: mm: zswap: properly synchronize freeing resources during CPU hotunplug In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the current... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the system, including memory management, process scheduling, and device control. The kernel is crucial for system stability and performance. This vulnerability specifically affects the zswap feature, which optimizes memory compression to improve system performance. The issue arises during CPU hotplug operations, potentially leading to resource mismanagement and system instability.
Vulnerability Detail
In the Linux kernel, a use-after-free (UAF) vulnerability has been identified in the zswap feature. This issue occurs when the per-CPU acomp_ctx is used during compression and decompression operations without proper synchronization during CPU hotunplug events. If the CPU is unplugged while acomp_ctx is still in use, it can lead to the freeing of resources that are still being referenced, resulting in undefined behavior and potential system crashes. This vulnerability was introduced in commit 1ec3b5fe6eec when the kernel switched to using the crypto_acomp API, which does not disable preemption or migration, increasing the risk of this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds recommended for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate risks associated with this vulnerability.
Conclusion
The identified UAF vulnerability in the Linux kernel's zswap feature poses significant risks to system stability and performance. Users are encouraged to update their kernel packages to the latest fixed versions to mitigate these risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory resource after it has been freed, leading to potential crashes or exploitation.
This vulnerability can lead to system instability, crashes, and undefined behavior, which can severely impact overall system performance.
If you are using the Linux kernel versions prior to 6.12.12-1 on Debian 13 or any version on Debian 12, your system may be affected. You can check for vulnerabilities using Vulert.
Vulert is a tool that monitors and alerts users about open-source vulnerabilities in their software by analyzing a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
