Critical Vulnerability in Linux Kernel: KASAN Report Exposure During Code Patching
Summary
DEBIAN-CVE-2025-21869: In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Disable KASAN report during patching via temporary mm Erhard reports the following KASAN hit on Talos II (power9) with kernel 6.1... Affects linux versions < 6.12.17-1. Fixed in 6.12.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. The kernel is crucial for system stability and performance. This vulnerability affects the Linux kernel versions prior to 6.12.17-1 in Debian 13 and 14, exposing systems to potential security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of KASAN (Kernel Address Sanitizer) reports during the code patching process. Specifically, when using a temporary memory management (mm) context for patching, the KASAN reports are not disabled, leading to potential user-memory access violations. This issue can result in unintended memory access, which may allow attackers to exploit the system, leading to data corruption or unauthorized access. The vulnerability was introduced in commit c28c15b6d28a and exacerbated by subsequent changes that utilized copy_to_kernel_nofault() for instruction copying.
How To Fix
Minimum fixed version
6.12.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable KASAN reports during the patching process, although this is not a permanent solution. It is advisable to apply the patch as soon as possible instead of relying on workarounds.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks related to memory access violations. It is crucial for users to update their systems to the patched version to ensure security and stability. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
KASAN stands for Kernel Address Sanitizer, a memory error detector for the Linux kernel that helps identify memory corruption issues.
This vulnerability can lead to unauthorized memory access, potentially allowing attackers to exploit the system and compromise data integrity.
The vulnerability affects Linux kernel versions prior to 6.12.17-1 in Debian 13 and 14.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider applying temporary workarounds, such as disabling KASAN reports, but prioritize applying the patch as soon as feasible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
