Double Free Vulnerability in Linux Kernel - Impacting Debian Packages
Summary
DEBIAN-CVE-2025-40062: In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs When the initialization of qm->debug.acc_diff_reg fails, the probe process does not exit. Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various distributions, including Debian. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access. This specific vulnerability affects the initialization process of the hisilicon/qm component, which is responsible for managing certain hardware functionalities.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the hisilicon/qm component where the qm->debug.qm_diff_regs is not set to NULL after being freed. This oversight occurs when the initialization of qm->debug.acc_diff_reg fails, leading to a scenario where the probe process does not exit. Consequently, if the remove process attempts to free qm->debug.qm_diff_regs again, it results in a double free condition, which can cause system instability and potential security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the kernel as mentioned above.
Conclusion
The identified double free vulnerability in the Linux kernel's hisilicon/qm component poses significant risks to system stability and security. Users are strongly advised to update their Linux kernel packages to the latest versions to mitigate these risks. Regular monitoring and updating of software are essential practices for maintaining a secure computing environment.
See every vulnerability recorded for linux →
FAQ
A double free vulnerability occurs when a program attempts to free a memory location that has already been freed. This can lead to unpredictable behavior, crashes, or security exploits.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json to Vulert, you can check for vulnerabilities without needing to install any software.
Failing to address this vulnerability can lead to system crashes, data corruption, or unauthorized access, potentially compromising the security of your system.
While this vulnerability is reported in Debian packages, it may also affect other distributions that utilize the same Linux kernel version. It is essential to check for updates across all systems.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are reported. Keeping your kernel up to date is crucial for system security.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
