vulnerability

Debian: CVE-2025-37995: linux, linux-6.1 -- security update

Severity
6
CVSS
(AV:L/AC:L/Au:S/C:C/I:N/A:C)
Published
May 29, 2025
Added
Jun 3, 2025
Modified
Oct 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

module: ensure that kobject_put() is safe for module type kobjects

In 'lookup_or_create_module_kobject()', an internal kobject is created
using 'module_ktype'. So call to 'kobject_put()' on error handling
path causes an attempt to use an uninitialized completion pointer in
'module_kobject_release()'. In this scenario, we just want to release
kobject without an extra synchronization required for a regular module
unloading process, so adding an extra check whether 'complete()' is
actually required makes 'kobject_put()' safe.

Solutions

debian-upgrade-linuxdebian-upgrade-linux-6-1no-fix-debian-deb-package
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.