UAF Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-22126: In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating all_mddevs list While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is use... Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various distributions, including Debian 12 and 13. This vulnerability pertains to a use-after-free (UAF) issue that arises during the iteration of the all_mddevs list, potentially compromising system stability and security.
Vulnerability Detail
In the Linux kernel, a use-after-free (UAF) vulnerability has been identified in the md subsystem. The issue occurs when the system iterates through the all_mddevs list in the md_notify_reboot() and md_exit() functions. The use of list_for_each_entry_safe allows for a race condition where an entry can be deleted while still being accessed, leading to dereferencing freed memory. This can result in unpredictable behavior, crashes, or exploitation by malicious actors. The vulnerability is rooted in improper handling of memory references during list operations.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no specific workaround provided for this vulnerability. However, it is advisable to avoid using the affected functions until the kernel is updated to mitigate potential risks.
Conclusion
The CVE-2025-22126 vulnerability in the Linux kernel poses significant risks to Debian users. It is essential to update the kernel to the latest patched version to ensure system security and stability. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22126 is a use-after-free vulnerability in the Linux kernel's md subsystem that can lead to system instability and potential exploitation.
This vulnerability can cause crashes or allow malicious actors to exploit freed memory, potentially leading to unauthorized access or data corruption.
Yes, both Debian 12 and 13 are affected by this vulnerability. It is crucial to update to the patched version of the Linux kernel.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
While there is no specific workaround, it is advisable to limit the use of the affected functions and monitor for updates to mitigate risks until the kernel can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
