Critical Memory Access Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-38269: In the Linux kernel, the following vulnerability has been resolved: btrfs: exit after state insertion failure at btrfs_convert_extent_bit() If insert_state() state failed it returns an error pointer and we call extent_io... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages system resources and hardware interactions, providing essential services for software applications. The kernel is known for its stability and performance, but like any complex software, it can have vulnerabilities. This specific vulnerability affects the btrfs file system, which is designed for high-performance storage management and data integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the btrfs file system related to state insertion failure at the function btrfs_convert_extent_bit(). When the insert_state() function fails, it returns an error pointer. If CONFIG_BUG is disabled, which is a rare configuration, the code may dereference this error pointer, leading to invalid memory access and potential system crashes. This vulnerability could allow an attacker to exploit the system, leading to data corruption or denial of service.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate risks.
Conclusion
The identified vulnerability in the Linux kernel's btrfs file system poses a significant risk due to potential invalid memory access. It is crucial for users of Debian 13 and 14 to update their systems to the patched version 6.12.35-1 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to invalid memory access, which may cause system crashes or data corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
While vulnerabilities in the Linux kernel are not uncommon, this specific issue is related to a rare configuration where CONFIG_BUG is disabled.
If immediate updates are not possible, consider isolating the affected system from critical networks to reduce the risk of exploitation.
You can find more information on the official Debian security advisories page or by monitoring vulnerability databases.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
