Kernel Crash Risk in Linux Package Due to Invalid CPU Handling
Summary
DEBIAN-CVE-2025-21965: In the Linux kernel, the following vulnerability has been resolved: sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() If a BPF scheduler provides an invalid CPU (outside the nr_cpu_ids range) as prev_cpu to scx_bp... Affects linux versions < 6.12.20-1. Fixed in 6.12.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for running applications and services, ensuring efficient communication between software and hardware. The Linux kernel is known for its stability and performance, but vulnerabilities can arise, potentially compromising system integrity and reliability.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2025-21965 affects the Linux kernel's BPF scheduler. It originates from a lack of validation for the 'prev_cpu' parameter in the 'scx_bpf_select_cpu_dfl()' function. If an invalid CPU number (outside the range of available CPUs) is provided, it can lead to a kernel crash, causing system instability and potential data loss. This issue underscores the importance of input validation in kernel-level programming.
How To Fix
Minimum fixed version
6.12.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk of a kernel crash.
Conclusion
The vulnerability DEBIAN-CVE-2025-21965 poses a significant risk to systems running affected versions of the Linux kernel. It is crucial for users to update their packages to the patched version to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
It is a vulnerability in the Linux kernel that can cause a kernel crash if an invalid CPU number is provided to the BPF scheduler.
If exploited, this vulnerability can lead to system instability and crashes, potentially resulting in data loss.
You should update your Linux package to version 6.12.20-1 or later to mitigate the vulnerability.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software without needing to access the code directly.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
