Memory Corruption Vulnerability in Linux Kernel's smartpqi Driver
Summary
DEBIAN-CVE-2025-37981: In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Use is_kdump_kernel() to check for kdump The smartpqi driver checks the reset_devices variable to determine whether special adjustments... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system operations. The smartpqi driver is responsible for managing certain storage devices, ensuring efficient data transfer and device communication. However, it has been found to have a vulnerability that can lead to memory corruption during kexec reboots, affecting system stability and performance.
Vulnerability Detail
In the Linux kernel, specifically within the smartpqi driver, a vulnerability has been identified where the driver incorrectly checks the reset_devices variable to determine if special adjustments are needed for kdump. This oversight can lead to significantly lower driver parameters, such as max_transfer_size, after a regular kexec reboot. More critically, it has been observed that memory corruption may occur due to the driver log being written to system memory post-kexec, which can compromise system integrity and lead to unpredictable behavior.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The vulnerability in the Linux kernel's smartpqi driver poses significant risks related to memory corruption during kexec reboots. Users are strongly advised to update to the patched version 6.12.25-1 to mitigate these risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring extensive setup.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to memory corruption during kexec reboots, potentially causing system instability and data loss.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, it can alert you in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Kexec is a system call that allows you to boot into a new kernel from the currently running kernel without going through the BIOS, which can speed up the reboot process.
While there are no specific workarounds, it is advisable to monitor the system closely for any unusual behavior and plan to apply the update as soon as possible.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37981.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
