CVE-2025-37995: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-37995) was discovered in the Linux kernel and disclosed on May 29, 2025. The issue affects the module subsystem, specifically related to the handling of kobject operations (NVD, Debian Tracker).

The vulnerability occurs in the 'lookuporcreatemodulekobject()' function where an internal kobject is created using 'modulektype'. When 'kobjectput()' is called on the error handling path, it attempts to use an uninitialized completion pointer in 'modulekobjectrelease()'. The issue has been assigned a CVSS v3.1 base score of 7.0 (High) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (Wiz).

The vulnerability affects various Linux distributions including Debian's bullseye, bookworm, and trixie releases. The issue could potentially lead to security implications when handling module operations in the Linux kernel (Debian Tracker).

Fixes have been released for several Linux distributions. Debian has addressed the vulnerability in bookworm with version 6.1.140-1 and in sid with version 6.12.30-1. Red Hat has marked this for deferred fixes in Red Hat Enterprise Linux 9 and 10 (Debian Tracker).