Kernel Vulnerability in Linux Package: Addressing Cached Destination Counters Issue
Summary
DEBIAN-CVE-2025-22057: In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dst_release Upstream fix ac888d58869b ("net: do not delay dst_entries_add() in dst_release()") moved decrementing t... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. The vulnerability in question affects the Linux kernel versions in Debian 13 and 14, specifically related to the handling of cached destination counters within the network subsystem.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the network subsystem where cached destination counters were not properly decremented during the release of destination entries. This issue arises when the CONFIG_DST_CACHE option is enabled and Open vSwitch (OvS) with tunnels is utilized. The flaw can lead to kernel paging requests at invalid memory addresses, potentially causing system instability or crashes. The upstream fix attempted to address this by modifying the decrementing process, but it was incomplete for cached destinations, leaving systems vulnerable to access violations.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the CONFIG_DST_CACHE option if it is not critical for your application. This can be done by modifying the kernel configuration and recompiling the kernel, although this approach may not be feasible for all users.
Conclusion
The vulnerability in the Linux kernel regarding cached destination counters poses a significant risk to system stability. It is crucial for users of Debian 13 and 14 to update their systems to the patched version 6.12.25-1 to mitigate this issue. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel crashes or system instability due to improper handling of memory addresses.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to version 6.12.25-1.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Consider applying the workaround of disabling CONFIG_DST_CACHE or monitoring your system closely for any unusual behavior until you can apply the fix.
Detailed information can be found in the Debian CVE database or by reviewing the Linux kernel mailing lists and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
