Critical UAF Vulnerability in Linux Kernel Affecting Debian Packages
Summary
DEBIAN-CVE-2025-21693: In the Linux kernel, the following vulnerability has been resolved: mm: zswap: properly synchronize freeing resources during CPU hotunplug In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the current... Affects linux versions < 6.12.12-1. Fixed in 6.12.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security. However, vulnerabilities can arise, impacting system integrity and security. This specific vulnerability affects the Linux kernel in Debian versions 13 and 14, highlighting the importance of timely updates and patches to maintain system security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the zswap feature, which improperly synchronizes resource freeing during CPU hotunplug. The issue arises in the zswap_compress() and zswap_decompress() functions, where the per-CPU acomp_ctx is used without ensuring that the operation remains on the same CPU. If the original CPU is hotunplugged while the acomp_ctx is still in use, it can lead to a use-after-free (UAF) bug, resulting in potential system instability or crashes. This vulnerability was introduced in commit 1ec3b5fe6eec when the kernel switched to using the crypto_acomp API for hardware acceleration, which does not disable preemption or migration, thus allowing the operation to continue on a different CPU.
How To Fix
Minimum fixed version
6.12.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The identified vulnerability in the Linux kernel affects Debian versions 13 and 14, posing a significant risk due to improper synchronization during CPU hotunplug. Users are strongly advised to update their kernel to the patched version 6.12.12-1 to mitigate this risk. Regular updates and monitoring for vulnerabilities are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory resource after it has been freed, potentially leading to crashes or arbitrary code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json to Vulert's playground, you can check for vulnerabilities without any signup.
If exploited, this vulnerability could lead to system instability, crashes, or unauthorized access to system resources, compromising the overall security of the system.
It is not recommended to continue using the affected versions, as they pose a security risk. Users should update to the patched version as soon as possible.
Detailed information can be found in the official Debian security advisories and the Linux kernel mailing lists, which discuss the vulnerability and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
