CVE-2025-23138: debian linux — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM. To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers() (It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?)

Is your site exposed to CVE-2025-23138?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
linux	linux_kernel	5.10.210 — 5.10.236
linux	linux_kernel	5.15.149 — 5.15.180
linux	linux_kernel	6.1.76 — 6.1.134
linux	linux_kernel	6.6.15 — 6.6.87
linux	linux_kernel	6.7.3 — 6.12.23
linux	linux_kernel	6.13 — 6.13.11
linux	linux_kernel	6.14 — 6.14.2
debian	debian_linux	All

References

Advisories & Patches

https://git.kernel.org/stable/c/205028ebba838938d3b264dda1d0708fa7fe1ade https://git.kernel.org/stable/c/2d680b988656bb556c863d8b46d9b9096842bf3d https://git.kernel.org/stable/c/471c89b7d4f58bd6082f7c1fe14d4ca15c7f1284 https://git.kernel.org/stable/c/56ec918e6c86c1536870e4373e91eddd0c44245f https://git.kernel.org/stable/c/6dafa27764183738dc5368b669b71e3d0d154f12 https://git.kernel.org/stable/c/8658c75343ed00e5e154ebbe24335f51ba8db547 https://git.kernel.org/stable/c/d40e3537265dea9e3c33021874437ff26dc18787 https://git.kernel.org/stable/c/f13abc1e8e1a3b7455511c4e122750127f6bc9b0

Other References

https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Frequently Asked Questions

What is CVE-2025-23138? +

In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM. To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers() (It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?) It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-23138? +

CVE-2025-23138 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-23138? +

CVE-2025-23138 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-23138? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-9588 10.0

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. …

CVE-2025-57870 10.0

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This …

CVE-2026-48286 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2026-13782 10.0

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer …

CVE-2026-48303 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2025-34028 10.0

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when …

CVE-2025-23138