Memory Allocation Profiling Vulnerability in Linux Kernel: Debian Packages Affected
Summary
DEBIAN-CVE-2025-37908: In the Linux kernel, the following vulnerability has been resolved: mm, slab: clean up slab->obj_exts always When memory allocation profiling is disabled at runtime or due to an error, shutdown_mem_profiling() is called:... Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services for software applications. It is known for its stability, performance, and flexibility, making it a popular choice for servers and desktops alike. However, vulnerabilities can arise, impacting system security and performance. This specific issue relates to improper handling of memory allocation profiling, which can lead to system errors and instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the memory management subsystem, specifically related to the slab allocator. When memory allocation profiling is disabled at runtime or due to an error, the function shutdown_mem_profiling() is invoked, but it fails to clear slab->obj_exts, which can lead to a bad page state error. This occurs because unaccount_slab() does not execute correctly when mem_alloc_profiling_enabled() is false, resulting in memory that remains incorrectly charged to a control group. This can cause significant system errors and instability, potentially leading to crashes or data loss.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel related to memory allocation profiling poses significant risks to system stability and security. Users of Debian 13 and 14 are urged to update their kernel to the patched version 6.12.29-1 to mitigate these risks. Regular monitoring and timely updates are essential to maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of memory allocation profiling in the Linux kernel, which can lead to system errors.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can lead to system instability, crashes, and potential data loss due to improper memory management.
Yes, a patch is available in version 6.12.29-1 for both Debian 13 and 14. Users should update their kernel to this version.
While there are no specific workarounds, it is recommended to monitor your system closely for any unusual behavior until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
