UAF Vulnerability in Linux Kernel's driver_override_show() Function - Impacting Debian Linux Packages
Summary
DEBIAN-CVE-2025-21915: In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_o... Affects linux versions < 6.12.19-1. Fixed in 6.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel is designed to be efficient and secure, but vulnerabilities can arise due to complex interactions between its components. This specific vulnerability affects the driver_override_show() function, which is part of the sysfs interface used for managing device drivers.
Vulnerability Detail
In the Linux kernel, a use-after-free (UAF) vulnerability has been identified in the driver_override_show() function within the cdx driver. This function can be executed concurrently with driver_override_store(), leading to a situation where driver_override_show() may access a freed pointer if driver_override_store() frees the string concurrently. This could result in the exposure of kernel addresses, posing a significant security risk as the DEVICE_ATTR can be read by all users.
How To Fix
Minimum fixed version
6.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
The UAF vulnerability in the Linux kernel's driver_override_show() function poses a significant risk to Debian systems. Users are strongly advised to update to the patched versions to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain system security.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to unpredictable behavior or security issues.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without requiring any installation.
The primary risk is that an attacker could exploit the vulnerability to access sensitive kernel memory, potentially leading to privilege escalation or system compromise.
While this report focuses on Debian packages, the underlying vulnerability exists in the Linux kernel and may affect other distributions that use the same kernel version.
If immediate updates are not possible, consider isolating the affected system from untrusted networks and monitoring it closely for any unusual activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
