Critical NULL Pointer Dereference in Linux Kernel Package: linux
Summary
DEBIAN-CVE-2025-38255: In the Linux kernel, the following vulnerability has been resolved: lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() While testing null_blk with configfs, echo 0 > poll_queues will trigger following... Affects linux versions < 6.12.37-1. Fixed in 6.12.37-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linux' package is a core component of the Debian operating system, providing the Linux kernel that manages system resources and hardware interactions. It is essential for the functioning of the operating system, enabling applications to run and hardware to communicate effectively. The vulnerability in question affects the kernel's ability to handle certain operations safely, potentially leading to system crashes.
Vulnerability Detail
In the Linux kernel, a NULL pointer dereference vulnerability has been identified in the function group_cpus_evenly(). This issue arises when the variable numgrps is set to zero, leading to a dereference of a ZERO_SIZE_PTR returned from kcalloc(). This can trigger a kernel panic, causing the system to crash. The vulnerability can be exploited during operations involving null_blk with configfs, where improper handling of CPU groups can lead to severe system instability.
How To Fix
Minimum fixed version
6.12.37-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to prevent potential system crashes.
Conclusion
The identified NULL pointer dereference vulnerability in the Linux kernel package 'linux' poses a significant risk to system stability. Users are urged to update to the patched version 6.12.37-1 to mitigate this risk. Regular updates and monitoring for vulnerabilities are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory at a location that has not been allocated, leading to crashes or unpredictable behavior.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the manifest file like package-lock.json, it can alert you in real-time. You can also check your application using the Vulert playground without signup.
Exploitation of this vulnerability can lead to kernel panics, causing the system to crash and potentially resulting in data loss or corruption.
Yes, this vulnerability affects specific versions of the Linux kernel in Debian 13 and 14, particularly those prior to the patched version 6.12.37-1.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
