Critical Memory Crash Vulnerability in Linux Package: DEBIAN-CVE-2025-21873
Summary
DEBIAN-CVE-2025-21873: In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: bsg: Fix crash when arpmb command fails If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io... Affects linux versions < 6.12.19-1. Fixed in 6.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing system resources and hardware interactions. It provides essential functionalities for device management, process scheduling, and memory management. This vulnerability specifically affects the SCSI (Small Computer System Interface) subsystem, which is crucial for communication between the operating system and storage devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SCSI UFS (Universal Flash Storage) core related to the bsg (Block Storage Generic) transport layer. The issue arises when the ARPMB (Authenticated Read Protected Memory Block) command fails, leading to a crash due to improper handling of user data in the bsg_transport_sg_io_fn() function. If the device does not support the ARPMB command, the kernel may crash, resulting in system instability and potential data loss. The vulnerability is traced back to the failure to set the job's reply length when an error occurs in ufs_bsg_exec_advanced_rpmb_req(). This can lead to memory corruption and crashes, as evidenced by the provided backtrace.
How To Fix
Minimum fixed version
6.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The DEBIAN-CVE-2025-21873 vulnerability poses a significant risk to systems running the Linux package, particularly in relation to SCSI UFS operations. Users are strongly encouraged to update to the patched version to ensure system stability and security. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security measures.
See every vulnerability recorded for linux →
FAQ
It is a critical vulnerability in the Linux kernel affecting the SCSI UFS subsystem, which can lead to system crashes.
If your system encounters a device that does not support the ARPMB command, it may crash, leading to potential data loss and instability.
Yes, the patched version is 6.12.19-1. Users should update their Linux package to this version to mitigate the risk.
While there are no specific workarounds, it is advisable to monitor your system closely and avoid using devices that may trigger this vulnerability until an update can be applied.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
