CVE-2025-37995
Description
In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe.
How to fix
- linux linux_kernel5.4.294, 5.10.238, 5.15.183, 6.1.139, 6.6.91, 6.12.29, 6.14.7 or later
- git.kernel.org/stable/c/31d8df3f303c3ae9115230820977ef8c35c88808
- git.kernel.org/stable/c/93799fb988757cdacf19acba57807746c00378e6
- git.kernel.org/stable/c/9e7b49ce4f9d0cb5b6e87db9e07a2fb9e754b0dd
- git.kernel.org/stable/c/a63d99873547d8b39eb2f6db79dd235761e7098a
- git.kernel.org/stable/c/a6aeb739974ec73e5217c75a7c008a688d3d5cf1
- git.kernel.org/stable/c/d63851049f412cdfadaeef7a7eaef5031d11c1e9
- git.kernel.org/stable/c/f1c71b4bd721a4ea21da408806964b10468623f2
- git.kernel.org/stable/c/faa9059631d3491d699c69ecf512de9e1a3d6649
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.12 ≤ v < 5.4.294, 5.5 ≤ v < 5.10.238, 5.11 ≤ v < 5.15.183, 5.16 ≤ v < 6.1.139, 6.2 ≤ v < 6.6.91, 6.7 ≤ v < 6.12.29, 6.13 ≤ v < 6.14.7, 6.15 | 5.4.294, 5.10.238, 5.15.183, 6.1.139, 6.6.91, 6.12.29, 6.14.7 |
| debian debian_linux | 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.