Use-After-Free Vulnerability in Linux Kernel - Impacting Debian Packages
Summary
CVE-2025-39877: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock. Affects linux versions < 6.1.153-1. Fixed in 6.1.153-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, vulnerabilities can arise, such as the one identified in the state_show() function, which can lead to serious security risks if not addressed promptly.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been discovered in the state_show() function within the mm/damon/sysfs module. This issue arises when state_show() accesses kdamond->damon_ctx without proper locking, allowing a race condition where the context can be freed while still being accessed. This can lead to undefined behavior, crashes, or potential exploitation by attackers. The vulnerability has existed since the initial implementation of state_show() and poses a significant risk to systems running affected versions of the Linux kernel.
How To Fix
Minimum fixed version
6.1.153-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The use-after-free vulnerability in the Linux kernel's state_show() function poses a significant risk to systems running affected Debian packages. It is crucial to apply the recommended updates to mitigate this risk and maintain system security.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to crashes or exploitation.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The risks include system crashes, data corruption, and potential exploitation by attackers to execute arbitrary code.
Yes, the vulnerability affects specific versions of the Linux kernel in Debian 12 and Debian 13, which need to be updated to the patched versions.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
