Critical Double Free Vulnerability in Linux Kernel Affecting Debian Packages
Summary
DEBIAN-CVE-2025-40096: In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting the overall security of the system. This specific vulnerability affects the Linux package across multiple Debian versions, highlighting the importance of timely updates and security patches.
Vulnerability Detail
In the Linux kernel, a critical vulnerability has been identified in the drm_sched_job_add_resv_dependencies function, which can lead to a double free error. This issue arises when adding dependencies with drm_sched_job_add_dependency(), where the function consumes the fence reference on both success and failure. In the event of a failure, this results in a double free during the error handling process, potentially leading to system instability or exploitation by malicious actors. The bug has existed since the introduction of dependency tracking in the kernel, making it crucial for users to address this vulnerability promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the necessary updates as soon as they are available.
Conclusion
The double free vulnerability in the Linux kernel poses a significant risk to Debian users. It is essential to stay informed about such vulnerabilities and apply the necessary updates to mitigate potential threats. Utilizing tools like Vulert can help monitor and alert users to open-source vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
A double free vulnerability occurs when a program attempts to free the same memory location more than once, which can lead to unpredictable behavior and potential exploitation.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check if your application is affected by this vulnerability.
If exploited, this vulnerability could lead to system crashes, unauthorized access, or other forms of exploitation that compromise system integrity.
While this vulnerability has been identified in Debian packages, it may also affect other distributions that utilize the same Linux kernel version. It is important to check for updates across all systems.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed. Regular updates help maintain system security and stability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
