Critical Use-After-Free Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-37916: In the Linux kernel, the following vulnerability has been resolved: pds_core: remove write-after-free of client_id A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-fre... Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various devices, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to severe system compromises. This specific vulnerability affects the Linux package in Debian versions 13 and 14, highlighting a critical flaw that could be exploited under certain conditions.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability was identified in the pds_core module, specifically in the function pdsc_auxbus_dev_del. This flaw arises when a write operation is attempted on a freed memory location, which can lead to unpredictable behavior, including potential system crashes or unauthorized access to sensitive data. The issue was observed during stress testing, indicating that it may be triggered under high-load scenarios. The vulnerability is particularly concerning due to the asynchronous nature of device uninitialization, which can lead to race conditions and further complicate the exploitation.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds recommended for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified use-after-free vulnerability in the Linux kernel poses significant risks to system stability and security. It is crucial for users of Debian versions 13 and 14 to update to the patched version promptly. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to crashes or exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability could lead to system crashes, unauthorized access to sensitive data, or other unpredictable behaviors.
Yes, updating to version 6.12.29-1 or later will mitigate the risks associated with this vulnerability.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the update as soon as possible to minimize risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
