Deadlock Vulnerability in Linux Kernel: linux Package Affected
Summary
DEBIAN-CVE-2025-37907: In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix locking order in ivpu_job_submit Fix deadlock in job submission and abort handling. Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for running applications and services on the system. The vulnerability in question arises from improper locking mechanisms within the kernel, specifically in the accel/ivpu module, which can lead to deadlocks during job submissions.
Vulnerability Detail
In the Linux kernel, a deadlock vulnerability has been identified in the accel/ivpu module. This issue occurs when a thread attempts to abort currently executing jobs while holding a global lock, leading to a situation where two threads are waiting on each other to release locks. The first thread locks the global lock protecting submitted jobs and then tries to release a context lock, while the second thread locks the context lock first and then attempts to acquire the global lock. This locking order creates a deadlock scenario, potentially causing system hangs and degraded performance.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk of deadlocks.
Conclusion
The deadlock vulnerability in the Linux kernel's accel/ivpu module poses significant risks to system stability and performance. Users are strongly advised to update their linux package to the patched version 6.12.29-1 to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the Linux kernel's accel/ivpu module, caused by improper locking order during job submissions.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install additional software.
If exploited, this vulnerability can lead to system hangs and degraded performance due to deadlocks in job processing.
Yes, a patch is available in version 6.12.29-1 of the linux package. Users should update to this version to fix the vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
