Deadlock Vulnerability in Linux Kernel: linux Package Affected
Summary
DEBIAN-CVE-2025-37745: In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() syzbot reported a deadlock in lock_system_sleep() (see below). Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for facilitating communication between software applications and hardware devices, ensuring efficient operation of the system. This vulnerability specifically affects the hibernate functionality of the kernel, which is crucial for power management in various devices.
Vulnerability Detail
In the Linux kernel, a deadlock vulnerability has been identified in the hibernate_compressor_param_set() function. This issue arises when a write operation to '/sys/module/hibernate/parameters/compressor' conflicts with the registration of ieee80211 devices, leading to a deadlock when acquiring the system_transition_mutex under param_lock. The deadlock occurs because the existing lock dependencies create a situation where the system cannot proceed, potentially freezing the system during hibernation. The vulnerability was reported by syzbot, highlighting the critical nature of this issue in power management scenarios.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the deadlock by refraining from modifying the hibernate compressor parameters while ieee80211 devices are being registered. This may help prevent the deadlock situation until the package can be updated.
Conclusion
The deadlock vulnerability in the Linux kernel's hibernation functionality poses a significant risk to system stability during power management operations. Users are advised to update their linux package to the latest version to mitigate this risk. Temporary workarounds can help, but a permanent fix is essential for long-term stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the Linux kernel's hibernation process, which can freeze the system during power management operations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to system freezes during hibernation, impacting system stability and user experience.
Yes, updating the linux package to version 6.12.25-1 or later will permanently fix the vulnerability.
If an immediate update is not possible, avoid modifying hibernation parameters while ieee80211 devices are being registered to prevent triggering the deadlock.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
