Critical Vulnerability in Linux Kernel: Potential Crash Due to BSG Queue Mismanagement
Summary
DEBIAN-CVE-2025-21723: In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix possible crash when setting up bsg fails If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value. Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is highly complex and is continuously updated to improve performance and security. This vulnerability specifically affects the SCSI (Small Computer System Interface) subsystem, which is crucial for communication between the operating system and storage devices. The issue arises from improper handling of the bsg_queue, which can lead to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SCSI subsystem related to the mpi3mr driver. When the function bsg_setup_queue() fails, it incorrectly assigns a non-NULL value to the bsg_queue. This leads to a situation where the condition in mpi3mr_bsg_exit() fails, preventing the execution from entering the bsg_remove_queue() function. As a result, this can cause a kernel NULL pointer dereference, leading to a crash. The specific error message generated is: 'BUG: kernel NULL pointer dereference, address: 000000000000041c'. This vulnerability can severely impact system stability and reliability.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel poses a significant risk to system stability due to improper handling of the bsg_queue. It is essential for users to update to the patched version 6.12.13-1 to mitigate this risk. Regular monitoring and prompt updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
This vulnerability can lead to system crashes due to a kernel NULL pointer dereference, affecting system stability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While no specific workarounds are available, it is crucial to monitor your system for any unusual behavior and plan to update as soon as possible.
Yes, this vulnerability affects specific versions of the Linux kernel, particularly those prior to the patched version 6.12.13-1.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21723.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
