Kernel Vulnerability in Linux Package: OOM Condition Handling in VMA Modification
Summary
DEBIAN-CVE-2025-37760: In the Linux kernel, the following vulnerability has been resolved: mm/vma: add give_up_on_oom option on modify/merge, use in uffd release Currently, if a VMA merge fails due to an OOM condition arising on commit merge o... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. The kernel is crucial for system stability and performance. This vulnerability pertains to the handling of Out Of Memory (OOM) conditions during Virtual Memory Area (VMA) modifications, which can lead to unexpected behavior in memory management.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the handling of OOM conditions during VMA modifications. Specifically, when a VMA merge fails due to an OOM condition, the system reports this failure to the caller. However, there are scenarios where the caller does not require a successful merge and can safely ignore OOM failures. To address this, a new option, 'give up on oom', has been introduced. When this flag is set, the system will not attempt to modify any VMAs if an OOM condition arises, thus preventing confusion in the handling of memory allocation errors. This vulnerability could lead to improper handling of memory pointers, potentially causing system instability or crashes.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid using the 'give up on oom' option unless necessary, as it may lead to unexpected behavior in memory management.
Conclusion
The identified vulnerability in the Linux kernel regarding OOM condition handling during VMA modifications poses a risk of system instability. Users are encouraged to update to the patched version to mitigate this risk. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to improper handling of memory pointers during VMA modifications, potentially causing system instability or crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the patched version of the Linux package is 6.12.25-1 for both Debian 13 and Debian 14.
While there are no specific workarounds, it is advisable to avoid using the 'give up on oom' option to minimize risks until you can update.
For more information, you can consult the official Debian security team or refer to the Linux kernel mailing list.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
