Critical Vulnerability in Linux Kernel: U64_MAX Slice Crash
Summary
DEBIAN-CVE-2025-37821: In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash There is a code path in dequeue_entities() that can set the slice of a sched_entity... Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services for applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting system reliability and security. This specific vulnerability affects the scheduling mechanism within the kernel, potentially leading to system crashes under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the scheduling code, specifically in the dequeue_entities() function. This issue arises when the slice of a sched_entity is incorrectly set to U64_MAX, which can lead to a series of cascading failures. When a delayed group entity is dequeued, and its parent's dequeue is also delayed, the slice remains U64_MAX. This can result in incorrect calculations of vruntime, causing the system to crash when the pick_next_entity() function attempts to dereference a NULL return value from pick_eevdf(). The ramifications include system instability and potential data loss.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the kernel to the fixed version.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks, including potential system crashes due to incorrect scheduling calculations. Users are strongly advised to update their kernel to the patched version 6.12.29-1 to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and instability, particularly when the scheduling mechanism encounters specific conditions.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the patched version of the Linux kernel is 6.12.29-1 for both Debian 13 and 14.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate risks.
The vulnerability can lead to incorrect scheduling decisions, which may degrade system performance and responsiveness, ultimately resulting in crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
