Critical Vulnerability in Linux Kernel: Duplicate pci_dev_put() in s390/pci
Summary
DEBIAN-CVE-2025-37946: In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs With commit bcb5d6c76903 ("s390/pci: introduce lock to synchronize state o... Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the s390 architecture, which is used in IBM mainframes, and involves a flaw in the PCI device management code.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the s390/pci subsystem where a duplicate call to pci_dev_put() in the disable_slot() function could lead to a use-after-free condition. This issue arose from a code change that altered the flow of execution, inadvertently leaving an existing pci_dev_put() call intact. As a result, if the struct pci_dev is released while in an unexpected state, it could lead to serious stability issues and potential security risks.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel's s390/pci subsystem poses significant risks due to a duplicate pci_dev_put() call. Users are advised to update their kernel to the patched version to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a duplicate call to pci_dev_put() in the Linux kernel's s390/pci code, which can lead to a use-after-free condition.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By uploading your manifest file like package-lock.json, you can check if your application is affected.
If exploited, this vulnerability could lead to system instability, crashes, or even unauthorized access to system resources.
Yes, a patch has been released in version 6.12.29-1 of the Linux kernel, which addresses this vulnerability.
You can use Vulert's playground to check for vulnerabilities in your applications without needing to sign up, ensuring you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
