Kernel Vulnerability in Linux Package: DMA Engine Free IRQ Issue
Summary
DEBIAN-CVE-2025-38479: In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: free irq correctly in remove path Add fsl_edma->txirq/errirq check to avoid below warning because no errirq at i.MX9 platform. Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing hardware interactions and system resources. It provides essential functionalities that allow the operating system to communicate with hardware devices. This package is critical for system stability and performance, making its security paramount. The vulnerability in question affects the DMA engine, specifically the Free IRQ handling, which can lead to kernel crashes under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the DMA engine related to the fsl-edma driver. The issue arises when the driver does not properly handle the free IRQ in the removal path, particularly on the i.MX9 platform where no error IRQ is present. This oversight can trigger kernel warnings and potentially lead to system instability or crashes, as evidenced by the warning message generated during the execution of the devm_free_irq function. The vulnerability is classified under DEBIAN-CVE-2025-38479 and affects versions prior to 6.12.25-1.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the latest version of the Linux package.
Conclusion
The vulnerability identified in the Linux package regarding the DMA engine's IRQ handling poses a significant risk to system stability. It is crucial for users to update to the patched version 6.12.25-1 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of open-source projects.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of the free IRQ in the DMA engine, which can lead to kernel warnings and potential crashes.
Versions prior to 6.12.25-1 are affected by this vulnerability.
You can check your system's Linux package version using the command 'uname -r' in the terminal.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using a manifest file like package-lock.json.
Detailed information about this vulnerability can be found in the Debian CVE database or by visiting the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
