Data Corruption Vulnerability in Linux Kernel: CVE-2025-21988
Summary
DEBIAN-CVE-2025-21988: In the Linux kernel, the following vulnerability has been resolved: fs/netfs/read_collect: add to next->prev_donated If multiple subrequests donate data to the same "next" request (depending on the subrequest completion... Affects linux versions < 6.12.20-1. Fixed in 6.12.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities. CVE-2025-21988 specifically affects the Linux kernel versions in Debian 13 and 14, where a flaw in the fs/netfs/read_collect function can lead to data corruption.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the fs/netfs/read_collect function. This issue arises when multiple subrequests attempt to donate data to the same 'next' request. Depending on the order of completion of these subrequests, each can overwrite the 'prev_donated' field, leading to data corruption and a subsequent crash (indicated by a BUG() message stating 'Can't donate prior to front'). This vulnerability can severely impact system stability and data integrity.
How To Fix
Minimum fixed version
6.12.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
CVE-2025-21988 represents a significant vulnerability in the Linux kernel that can lead to data corruption and system crashes. Users are strongly advised to update their systems to the patched version 6.12.20-1 to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21988 is a vulnerability in the Linux kernel that can lead to data corruption and system crashes due to improper handling of data donations in the fs/netfs/read_collect function.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the patch version 6.12.20-1.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Failing to address this vulnerability can lead to data corruption, system instability, and potential crashes, which may result in loss of data and service interruptions.
Yes, Vulert provides a service that allows you to monitor and receive alerts for open-source vulnerabilities in your software in real-time, using just a manifest file.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
