Kernel Panic Vulnerability in Linux Package: ublk Recovery Issue
Summary
DEBIAN-CVE-2025-37759: In the Linux kernel, the following vulnerability has been resolved: ublk: fix handling recovery & reissue in ublk_abort_queue() Commit 8284066946e6 ("ublk: grab request reference when the request is handled by userspace"... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionality for managing hardware and system resources. It is widely used in various environments, including servers and desktops. The package is known for its stability and performance, but like any software, it can be susceptible to vulnerabilities that may compromise system integrity and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ublk subsystem related to the handling of recovery and reissue in the ublk_abort_queue() function. Specifically, a commit did not properly grab a request reference during recovery reissue, which could lead to a situation where a request is requeued and re-dispatched after being freed. This can result in a kernel panic due to a NULL pointer dereference, causing system instability and potential data loss.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel related to the ublk subsystem poses a significant risk of kernel panic and system instability. It is crucial for users to update to the patched version to mitigate these risks and ensure system reliability.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel panic, causing system crashes and potential data loss.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in version 6.12.25-1 of the Linux package.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible.
Detailed information can be found in the Debian CVE database or by checking the official Linux kernel documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
