Admin Queue Overflow Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-37987: In the Linux kernel, the following vulnerability has been resolved: pds_core: Prevent possible adminq overflow/stuck condition The pds_core's adminq is protected by the adminq_lock, which prevents more than 1 command to... Affects linux versions < 6.12.27-1. Fixed in 6.12.27-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is designed for stability, performance, and security, making it a critical element in various computing environments. The kernel's functionality includes process management, memory management, device management, and system calls. However, vulnerabilities can arise, such as the one identified in the pds_core module, which can lead to potential system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the pds_core module related to the admin queue (adminq). The adminq is protected by a lock to prevent multiple commands from being posted simultaneously. However, completions occur in a different context, allowing multiple commands to be queued sequentially. The adminq request queue is limited to 16 entries, and the lack of a robust retry mechanism can lead to the adminq becoming stuck, preventing command processing and completion notifications from being sent. This vulnerability can result in system performance degradation and operational issues.
How To Fix
Minimum fixed version
6.12.27-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, users should limit the number of outstanding adminq commands to a maximum of 16 to prevent the adminq from getting stuck. This can be managed by ensuring that no more than 16 commands are queued at any time.
Conclusion
The identified vulnerability in the Linux kernel's pds_core module poses a risk of admin queue overflow, which can lead to system performance issues. Users are advised to update to the patched version 6.12.27-1 to mitigate this risk. In the meantime, limiting the number of outstanding commands can serve as a temporary workaround.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows for an overflow condition in the admin queue, potentially leading to system instability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability can cause the admin queue to become stuck, leading to degraded system performance and unresponsive commands.
Yes, a patch is available in version 6.12.27-1 of the Linux package. Users should update to this version or later.
If an immediate update is not possible, ensure that no more than 16 adminq commands are queued at any time to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
