Memory Leak Vulnerability in Linux Kernel: Impacting Debian Packages
Summary
DEBIAN-CVE-2025-38258: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write memcg_path_store() assigns a newly allocated memory buffer to filter->me... Affects linux versions < 6.12.37-1. Fixed in 6.12.37-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. This vulnerability affects Debian versions 13 and 14, specifically in the 'linux' package, which is crucial for system stability and performance.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mm/damon/sysfs-schemes component. The issue arises in the memcg_path_store() function, which assigns a newly allocated memory buffer to filter->memcg_path without deallocating the previously allocated memory buffer. This oversight allows users to leak kernel memory by continuously writing data to the memcg_path DAMOS sysfs file, potentially leading to system instability and security risks.
How To Fix
Minimum fixed version
6.12.37-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The identified memory leak vulnerability in the Linux kernel poses significant risks to Debian systems. It is crucial for users to update their 'linux' package to the patched version 6.12.37-1 to mitigate these risks. Regular monitoring with tools like Vulert can help ensure that systems remain secure against such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a memory leak in the Linux kernel that allows users to leak kernel memory by writing to a specific sysfs file.
Debian versions 13 and 14 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability could lead to system instability and unauthorized access to kernel memory, posing security risks.
Yes, a patch is available in version 6.12.37-1 of the 'linux' package for both Debian 13 and 14.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
