CVE-2025-37995

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37995
In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/31d8df3f303c3ae9115230820977ef8c35c88808 Patch
https://git.kernel.org/stable/c/93799fb988757cdacf19acba57807746c00378e6 Patch
https://git.kernel.org/stable/c/9e7b49ce4f9d0cb5b6e87db9e07a2fb9e754b0dd Patch
https://git.kernel.org/stable/c/a63d99873547d8b39eb2f6db79dd235761e7098a Patch
https://git.kernel.org/stable/c/a6aeb739974ec73e5217c75a7c008a688d3d5cf1 Patch
https://git.kernel.org/stable/c/d63851049f412cdfadaeef7a7eaef5031d11c1e9 Patch
https://git.kernel.org/stable/c/f1c71b4bd721a4ea21da408806964b10468623f2 Patch
https://git.kernel.org/stable/c/faa9059631d3491d699c69ecf512de9e1a3d6649 Patch
https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

16 Dec 2025, 20:20

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/31d8df3f303c3ae9115230820977ef8c35c88808 - () https://git.kernel.org/stable/c/31d8df3f303c3ae9115230820977ef8c35c88808 - Patch
References () https://git.kernel.org/stable/c/93799fb988757cdacf19acba57807746c00378e6 - () https://git.kernel.org/stable/c/93799fb988757cdacf19acba57807746c00378e6 - Patch
References () https://git.kernel.org/stable/c/9e7b49ce4f9d0cb5b6e87db9e07a2fb9e754b0dd - () https://git.kernel.org/stable/c/9e7b49ce4f9d0cb5b6e87db9e07a2fb9e754b0dd - Patch
References () https://git.kernel.org/stable/c/a63d99873547d8b39eb2f6db79dd235761e7098a - () https://git.kernel.org/stable/c/a63d99873547d8b39eb2f6db79dd235761e7098a - Patch
References () https://git.kernel.org/stable/c/a6aeb739974ec73e5217c75a7c008a688d3d5cf1 - () https://git.kernel.org/stable/c/a6aeb739974ec73e5217c75a7c008a688d3d5cf1 - Patch
References () https://git.kernel.org/stable/c/d63851049f412cdfadaeef7a7eaef5031d11c1e9 - () https://git.kernel.org/stable/c/d63851049f412cdfadaeef7a7eaef5031d11c1e9 - Patch
References () https://git.kernel.org/stable/c/f1c71b4bd721a4ea21da408806964b10468623f2 - () https://git.kernel.org/stable/c/f1c71b4bd721a4ea21da408806964b10468623f2 - Patch
References () https://git.kernel.org/stable/c/faa9059631d3491d699c69ecf512de9e1a3d6649 - () https://git.kernel.org/stable/c/faa9059631d3491d699c69ecf512de9e1a3d6649 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
CWE CWE-824
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

03 Nov 2025, 20:18

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html -

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -

04 Jun 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/93799fb988757cdacf19acba57807746c00378e6 -
  • () https://git.kernel.org/stable/c/a63d99873547d8b39eb2f6db79dd235761e7098a -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: módulo: garantizar que kobject_put() sea seguro para el tipo de módulo kobjects. En 'lookup_or_create_module_kobject()', se crea un kobject interno mediante 'module_ktype'. Por lo tanto, la llamada a 'kobject_put()' en la ruta de gestión de errores provoca un intento de usar un puntero de finalización no inicializado en 'module_kobject_release()'. En este escenario, solo queremos liberar kobject sin una sincronización adicional requerida para un proceso de descarga de módulo normal, por lo que añadir una comprobación adicional si 'complete()' es realmente necesario hace que 'kobject_put()' sea seguro.

29 May 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-29 14:15

Updated : 2025-12-16 20:20

NVD link : CVE-2025-37995

Mitre link : CVE-2025-37995

CVE.ORG link : CVE-2025-37995

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-824

Access of Uninitialized Pointer