Critical Vulnerability in Linux Kernel: Deadlock Risk in Zone Write Plug Handling
Summary
DEBIAN-CVE-2025-38302: In the Linux kernel, the following vulnerability has been resolved: block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work Bios queued up in the zone write plug have already gone through all all preparatio... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of a Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, like any complex software, it can have vulnerabilities that may affect its functionality and security. This specific vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the handling of block I/O operations in zone write plugs.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the function submit_bio_noacct_nocheck is improperly used in the blk_zone_wplug_bio_work process. This function is intended to bypass certain checks, but in this context, it leads to redundant operations that can cause deadlocks when freezing a queue with pending bio write plugs. The issue arises because bios queued in the zone write plug have already undergone necessary preparations, and the additional submission through submit_bio_noacct_nocheck is unnecessary and harmful.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than applying the patch. It is recommended to update to the fixed version as soon as possible to mitigate any risks.
Conclusion
This report outlines a critical vulnerability in the Linux kernel that can lead to deadlocks due to improper handling of block I/O operations. It is essential for users of Debian 13 and 14 to update their systems to the patched version 6.12.35-1 to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of block I/O operations in the Linux kernel, which can lead to deadlocks.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.12.35-1.
You can check your system's kernel version using the command 'uname -r' in the terminal.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file like package-lock.json.
Detailed information can be found in the Debian CVE database or by visiting the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
