NULL Pointer Dereference in Linux Kernel's USB Type-C Class - linux Package Vulnerability
Summary
DEBIAN-CVE-2025-37809: In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Fix NULL pointer access Concurrent calls to typec_partner_unlink_device can lead to a NULL pointer dereference. Affects linux versions < 6.12.27-1. Fixed in 6.12.27-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the USB Type-C class within the kernel, which is responsible for managing USB connections and devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the USB Type-C class that can lead to a NULL pointer dereference. This issue arises from concurrent calls to the function typec_partner_unlink_device, which can result in a NULL pointer access. The vulnerability is significant as it can cause system crashes or instability when multiple USB devices are being managed simultaneously. The patch introduced adds a mutex to protect USB device pointers, ensuring that the device pointers and partner device registration are safeguarded against this issue.
How To Fix
Minimum fixed version
6.12.27-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to limit the use of concurrent USB device management until the patch is applied.
Conclusion
The identified vulnerability in the Linux kernel's USB Type-C class poses a risk of system instability due to NULL pointer dereference. Users are encouraged to update their linux package to the patched version to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference that can occur due to concurrent calls to a specific function in the USB Type-C class of the Linux kernel.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can lead to system crashes or instability, particularly when managing multiple USB devices simultaneously.
Yes, a patch has been released in version 6.12.27-1 of the linux package to address this vulnerability.
While there are no specific workarounds, it is advisable to limit the use of concurrent USB device management until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
