CVE-2025-37995: debian linux — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe.

Is your site exposed to CVE-2025-37995?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-824 CWE-824

Affected Products

Vendor	Product	Versions
linux	linux_kernel	3.12 — 5.4.294
linux	linux_kernel	5.5 — 5.10.238
linux	linux_kernel	5.11 — 5.15.183
linux	linux_kernel	5.16 — 6.1.139
linux	linux_kernel	6.2 — 6.6.91
linux	linux_kernel	6.7 — 6.12.29
linux	linux_kernel	6.13 — 6.14.7
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
debian	debian_linux	All

References

Advisories & Patches

https://git.kernel.org/stable/c/31d8df3f303c3ae9115230820977ef8c35c88808 https://git.kernel.org/stable/c/93799fb988757cdacf19acba57807746c00378e6 https://git.kernel.org/stable/c/9e7b49ce4f9d0cb5b6e87db9e07a2fb9e754b0dd https://git.kernel.org/stable/c/a63d99873547d8b39eb2f6db79dd235761e7098a https://git.kernel.org/stable/c/a6aeb739974ec73e5217c75a7c008a688d3d5cf1 https://git.kernel.org/stable/c/d63851049f412cdfadaeef7a7eaef5031d11c1e9 https://git.kernel.org/stable/c/f1c71b4bd721a4ea21da408806964b10468623f2 https://git.kernel.org/stable/c/faa9059631d3491d699c69ecf512de9e1a3d6649

Other References

https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Frequently Asked Questions

What is CVE-2025-37995? +

In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-37995? +

CVE-2025-37995 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-37995? +

CVE-2025-37995 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-37995? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-14739

Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack …

CVE-2025-66588 9.8

In AzeoTech DAQFactory release 20.7 (Build 2555), an Access of Uninitialized Pointer vulnerability can be exploited by an attacker which …

CVE-2026-16353 9.8

Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR …

CVE-2025-32451 8.8

A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized pointer. A specially crafted …

CVE-2023-43531 8.4

Memory corruption while verifying the serialized header when the key pairs are generated.

CVE-2024-57943 7.8

In the Linux kernel, the following vulnerability has been resolved: exfat: fix the new buffer was not zeroed before writing …

CVE-2025-37995