Synchronous Abort Vulnerability in Linux Kernel - Impacting Debian Packages
Summary
DEBIAN-CVE-2025-38631: In the Linux kernel, the following vulnerability has been resolved: clk: imx95-blk-ctl: Fix synchronous abort When enabling runtime PM for clock suppliers that also belong to a power domain, the following crash is thrown... Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is highly modular, allowing for various functionalities to be added or removed as needed. This vulnerability specifically affects the Linux kernel versions in Debian 13 and 14, where enabling runtime power management for clock suppliers can lead to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified that occurs when enabling runtime power management (PM) for clock suppliers that are part of a power domain. This can lead to a synchronous external abort error, causing the system to crash. The issue arises from the improper handling of device resumption, which results in a power domain cutoff after the clock is registered. The crash occurs when the clock hardware provider attempts to access the BLK_CTL register, leading to instability in the system.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable runtime power management for the affected clock suppliers until the package is updated. This can be done by modifying the device configuration files to prevent the runtime PM from being enabled.
Conclusion
The identified vulnerability in the Linux kernel can lead to significant system instability if not addressed. Users are encouraged to update their systems to the latest patched versions to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a crash caused by improper handling of runtime power management in the Linux kernel.
The vulnerability affects Linux kernel versions prior to 6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup required.
If exploited, this vulnerability can lead to system crashes, resulting in loss of data and service interruptions.
Yes, updating to the patched versions of the Linux kernel will permanently fix the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
