CVE-2025-37995 Details
Description
In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for module type kobjects In 'lookup_or_create_module_kobject()', an internal kobject is created using 'module_ktype'. So call to 'kobject_put()' on error handling path causes an attempt to use an uninitialized completion pointer in 'module_kobject_release()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe.
A vulnerability has been identified in the Linux kernel's module kobject management. The issue arises in the 'lookup_or_create_module_kobject()' function, where an internal kobject is created using 'module_ktype'. If an error occurs, the subsequent call to 'kobject_put()' in the error handling path can lead to the use of an uninitialized completion pointer in 'module_kobject_release()'. This situation requires releasing the kobject without the usual synchronization needed for a standard module unloading process. To address this, an additional check has been introduced to determine whether 'complete()' is necessary, making 'kobject_put()' safe.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/31d8df3f303c3ae9115230820977ef8c35c88808 | kernel.org | Patch |
| https://git.kernel.org/stable/c/93799fb988757cdacf19acba57807746c00378e6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9e7b49ce4f9d0cb5b6e87db9e07a2fb9e754b0dd | kernel.org | Patch |
| https://git.kernel.org/stable/c/a63d99873547d8b39eb2f6db79dd235761e7098a | kernel.org | Patch |
| https://git.kernel.org/stable/c/a6aeb739974ec73e5217c75a7c008a688d3d5cf1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d63851049f412cdfadaeef7a7eaef5031d11c1e9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f1c71b4bd721a4ea21da408806964b10468623f2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/faa9059631d3491d699c69ecf512de9e1a3d6649 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html | CVE | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-824 | Access of Uninitialized Pointer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 3.12, < 5.4.294 >= 5.5, < 5.10.238 >= 5.11, < 5.15.183 >= 5.16, < 6.1.139 >= 6.2, < 6.6.91 >= 6.7, < 6.12.29 >= 6.13, < 6.14.7 6.15 rc1 6.15 rc2 6.15 rc3 6.15 rc4 6.15 rc5 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 16, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Nov 3, 2025 | CVE Modified | CVE |
| Jun 4, 2025 | CVE Modified | kernel.org |
| May 29, 2025 | New CVE Received | kernel.org |