Critical Vulnerability in Linux Kernel: PDS_CORE_CMD_FW_CONTROL Command Handling
Summary
DEBIAN-CVE-2025-37887: In the Linux kernel, the following vulnerability has been resolved: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result If the FW doesn't support the PDS_CORE_CMD_FW_CONTROL command the driver might at the least... Affects linux versions < 6.12.27-1. Fixed in 6.12.27-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the handling of the PDS_CORE_CMD_FW_CONTROL command, which can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of the PDS_CORE_CMD_FW_CONTROL command. If the firmware does not support this command, the driver may print garbage values or crash when the 'devlink dev info' command is executed. This occurs because the stack variable 'fw_list' is not initialized to zero, leading to 'fw_list.num_fw_slots' containing a garbage value. Consequently, the driver may attempt to access 'fw_list.fw_names[i]' with 'i' exceeding the array size, resulting in out-of-bounds access and potential crashes.
How To Fix
Minimum fixed version
6.12.27-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The vulnerability in the Linux kernel regarding the PDS_CORE_CMD_FW_CONTROL command poses significant risks to system stability. It is crucial for users to update their systems to the patched version to mitigate these risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring extensive setup.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or instability when executing specific commands related to firmware control.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in version 6.12.27-1 of the Linux package. Updating to this version will resolve the vulnerability.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible.
Detailed information can be found in the Debian CVE database or by visiting the provided source link in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
