Critical UAF Vulnerability in Linux Kernel Affecting Debian Packages
Summary
DEBIAN-CVE-2025-38734: In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 00000000... Affects linux versions < 6.12.48-1. Fixed in 6.12.48-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, such as the one identified in this report, which affects versions of the Linux kernel in Debian 13 and 14.
Vulnerability Detail
In the Linux kernel, a use-after-free (UAF) vulnerability has been identified in the net/smc module. This issue occurs when the socket is released while still being accessed, leading to potential kernel NULL pointer dereference errors. The vulnerability can be exploited if an application closes a socket immediately after it is accepted, resulting in a crash or unexpected behavior. The root cause lies in the improper handling of socket states during the connection process, specifically after the smc_listen_out_connected() function is called.
How To Fix
Minimum fixed version
6.12.48-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate risks.
Conclusion
The identified UAF vulnerability in the Linux kernel poses significant risks to systems running Debian 13 and 14. Immediate action is required to update the affected packages to their patched versions to mitigate these risks. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A UAF vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to crashes or exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can lead to system crashes, data corruption, or unauthorized access to system resources.
Yes, if exploited, it may lead to unexpected behavior or crashes, which could result in data loss.
It is recommended to regularly check for updates and apply them promptly to ensure your system is secure against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
