Critical Write Failure in Linux Kernel: SST SPI-NOR Vulnerability
Summary
DEBIAN-CVE-2025-21845: In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: sst: Fix SST write failure 'commit 18bcb4aa54ea ("mtd: spi-nor: sst: Factor out common write operation to sst_nor_write_data()")' introduc... Affects linux versions < 6.12.17-1. Fixed in 6.12.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system operations. It supports a wide range of hardware architectures and is known for its stability and performance. The kernel's functionality includes process management, memory management, device drivers, and system calls. However, it is also susceptible to vulnerabilities that can compromise system integrity and performance. This specific vulnerability affects the 'linux' package in Debian versions 13 and 14, particularly in the MTD (Memory Technology Device) subsystem, which manages flash memory devices.
Vulnerability Detail
In the Linux kernel, a vulnerability was introduced in the MTD subsystem related to the SST SPI-NOR driver. The issue arises from a bug in the function 'sst_nor_write_data()', where only one byte of data is written regardless of the number of bytes requested. This leads to a kernel crash during write operations, potentially resulting in data loss or system instability. The vulnerability was introduced by commit 18bcb4aa54ea, which aimed to factor out common write operations but inadvertently caused this critical failure. The call trace indicates that the issue can lead to significant system errors, making it crucial to address promptly.
How To Fix
Minimum fixed version
6.12.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The vulnerability in the Linux kernel's SST SPI-NOR driver poses a significant risk to system stability and data integrity. Users are strongly encouraged to update their systems to the patched version to mitigate these risks. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a write failure in the SST SPI-NOR driver of the Linux kernel, causing only one byte to be written instead of the intended number.
It can lead to kernel crashes during write operations, potentially resulting in data loss and system instability.
Yes, a patch is available in version 6.12.17-1 of the 'linux' package. Users should update to this version or later.
While there are no specific workarounds, it is advisable to monitor the situation and apply the patch as soon as possible.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
