Kernel Panic Vulnerability in Linux Package: CVE-2025-21974
Summary
DEBIAN-CVE-2025-21974: In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc() The bnxt_queue_mem_alloc() is called to allocate new queue memory when a queue is... Affects linux versions < 6.12.20-1. Fixed in 6.12.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is responsible for facilitating communication between software applications and hardware devices. This package is critical for system stability and performance, and vulnerabilities within it can lead to severe operational issues, including system crashes.
Vulnerability Detail
The vulnerability identified as CVE-2025-21974 arises from a flaw in the bnxt_queue_mem_alloc() function within the Linux kernel. This function is responsible for allocating memory for network queues. If the function is called while the network interface is down, it can lead to a kernel panic, causing the system to crash. The panic occurs due to an attempt to access a memory address that is no longer valid, resulting in a page fault. This vulnerability can be exploited in scenarios where network interfaces are improperly managed, leading to significant system instability.
How To Fix
Minimum fixed version
6.12.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that network interfaces are properly managed and not restarted while they are down. This can help mitigate the risk of triggering the kernel panic until the package is updated.
Conclusion
CVE-2025-21974 is a critical vulnerability in the Linux kernel that can lead to kernel panics if not properly managed. Users are advised to update their Linux package to the patched version to ensure system stability and security. Proper management of network interfaces can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21974 is a vulnerability in the Linux kernel that can cause a kernel panic if a network queue is restarted while the interface is down.
This vulnerability can lead to system crashes, causing instability and potential data loss if not addressed.
Yes, a patched version of the Linux package (6.12.20-1) is available to fix this vulnerability.
As a temporary measure, ensure that network interfaces are managed properly to avoid triggering the kernel panic.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
