Kernel Crash Vulnerability in Linux Package Due to Blocksize Race Condition
Summary
DEBIAN-CVE-2025-38073: In the Linux kernel, the following vulnerability has been resolved: block: fix race between set_blocksize and read paths With the new large sector size support, it's now the case that set_blocksize can change i_blksize a... Affects linux versions < 6.12.32-1. Fixed in 6.12.32-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is responsible for handling system calls, managing memory, and facilitating communication between hardware and software. This vulnerability arises from a race condition between the set_blocksize function and concurrent read operations, which can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a race condition exists between the set_blocksize function and read paths, particularly when handling block devices with varying sector sizes. When a block device is accessed concurrently by different processes, a change in block size can lead to a scenario where a read operation attempts to use an invalid block device reference, ultimately causing a kernel crash. This vulnerability is critical as it can lead to system downtime and data loss, especially in environments relying on stable block device operations.
How To Fix
Minimum fixed version
6.12.32-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid mounting filesystems with different sector sizes on the same block device while the system is under heavy load. This can help mitigate the risk of encountering the race condition until the package is updated.
Conclusion
The vulnerability identified in the Linux package poses significant risks due to a race condition that can lead to kernel crashes. Users are strongly advised to update to the patched version to mitigate these risks. Temporary workarounds can be employed while awaiting updates, but the best course of action is to ensure the system is running the latest software.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition between the set_blocksize function and read operations in the Linux kernel, which can lead to kernel crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential system crashes, data loss, and instability in environments that rely on block device operations.
Yes, the patch is available in version 6.12.32-1 of the Linux package. Users should update to this version or later.
If immediate updates are not possible, consider avoiding operations that involve changing block sizes on the same device to reduce the risk of encountering the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
