Kernel Panic Risk in Linux Packages Due to Regulator Handling Error
Summary
CVE-2025-22095: In the Linux kernel, the following vulnerability has been resolved: PCI: brcmstb: Fix error path after a call to regulator_bulk_get() If the regulator_bulk_get() returns an error and no regulators are created, we need to... Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and extensive hardware support. However, vulnerabilities can arise, such as the one identified in CVE-2025-22095, which affects the handling of regulators in the PCI subsystem. This vulnerability can lead to system instability and kernel panics if not addressed promptly.
Vulnerability Detail
CVE-2025-22095 is a vulnerability in the Linux kernel related to the PCI subsystem, specifically in the brcmstb driver. The issue arises when the regulator_bulk_get() function fails to retrieve regulators, leading to an incorrect state where the number of regulators is not set to zero. If the PCIe link fails afterward, calling regulator_bulk_free() can cause a kernel panic, resulting in system crashes and potential data loss. This vulnerability highlights the importance of proper error handling in kernel code to maintain system stability.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-22095 is a significant vulnerability in the Linux kernel that can lead to severe system instability. It is crucial to update your Linux packages to the latest versions to mitigate the risk of kernel panics. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22095 is a vulnerability in the Linux kernel that can lead to kernel panics due to improper handling of regulator errors in the PCI subsystem.
If your system encounters this vulnerability, it may experience kernel panics, leading to crashes and potential data loss during PCIe link failures.
The vulnerability affects Linux packages in Debian 12 and 13. You should check your installed version and update to the latest patched version.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
