Race Condition Vulnerability in Linux Kernel: Impacting Debian Packages
Summary
DEBIAN-CVE-2025-38717: In the Linux kernel, the following vulnerability has been resolved: net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time... Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel is known for its stability and performance, but like any complex software, it can have vulnerabilities. This specific vulnerability affects the Linux kernel versions in Debian 13 and 14, highlighting the importance of timely updates to maintain system integrity.
Vulnerability Detail
In the Linux kernel, a race condition was discovered in the kcm_unattach() function. This occurs when kcm_unattach(psock) and kcm_release(kcm) are executed simultaneously. The function fails to check the kcm->tx_stopped flag before calling queue_work(), which can lead to a situation where kcm_unattach() is executed between cancel_work_sync() and unreserve_psock() in kcm_release(). This flaw may cause kcm->tx_work to be requeued just before kcm is freed in kcm_done(), potentially leading to system instability or crashes.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patches by updating the kernel as mentioned above.
Conclusion
The race condition vulnerability in the Linux kernel presents a significant risk to Debian systems. It is crucial for users to update their kernel packages to the patched versions to mitigate potential threats. Regular system maintenance and vulnerability monitoring are essential for maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
A race condition occurs when two or more processes access shared data and try to change it at the same time. This can lead to unpredictable results and system instability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Failure to address this vulnerability may lead to system crashes, data corruption, or exploitation by malicious actors, compromising system security.
While this vulnerability is documented for Debian packages, the underlying issue exists in the Linux kernel itself, which may affect other distributions as well.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
