Critical SCSI Error Handling Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-21656: In the Linux kernel, the following vulnerability has been resolved: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur scsi_execute_cmd() function can return both negative (linux codes) and posit... Affects linux versions < 6.12.10-1. Fixed in 6.12.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. This vulnerability affects the hwmon subsystem, which is responsible for monitoring hardware health, including temperature and voltage levels. The specific issue arises from improper handling of SCSI error codes, leading to potential data exposure.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the hwmon subsystem related to the drivetemp driver. The scsi_execute_cmd() function can return both negative and positive error codes. The driver incorrectly passes these error codes to the hwmon core, which only checks for negative codes. As a result, in the event of SCSI errors, hwmon may report uninitialized data to userspace, potentially exposing sensitive information if a disk drive is disconnected. This flaw can lead to data integrity issues and unreliable system behavior.
How To Fix
Minimum fixed version
6.12.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can monitor SCSI devices closely and ensure that they are properly connected to avoid triggering the vulnerability. However, this is not a permanent solution and updating the kernel is strongly recommended.
Conclusion
The vulnerability in the Linux kernel's hwmon subsystem poses a significant risk due to improper handling of SCSI error codes, which can lead to the exposure of uninitialized data. It is crucial for users to update to the patched version to mitigate this risk and ensure system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of SCSI error codes in the hwmon subsystem of the Linux kernel, leading to potential exposure of uninitialized data.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to data integrity issues and unreliable system behavior, potentially exposing sensitive information to userspace.
Yes, the patched version of the Linux kernel is 6.12.10-1 for both Debian 13 and Debian 14.
If an immediate update is not possible, ensure that all SCSI devices are properly connected and monitored to minimize the risk of triggering the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
