# CVE-2025-6297: dpkg: It was discovered that dpkg-deb does not properly sanitize directorypermissions when extracting a control member into...

CVE-2025-6297 is fixed in 4 products on 1 platform, first by dpkg 1.21.1ubuntu2.6, released July 1, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-6297
- Priority: High
- CVSS: 8.2 (Low)
- EPSS: 0.0048
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 1, 2025

## Description

It was discovered that dpkg-deb does not properly sanitize directorypermissions when extracting a control member into a temporary directory,which isdocumented as being a safe operation even on untrusted data. This mayresult in leaving temporary files behind on cleanup. Given automated andrepeated execution of dpkg-deb commands onadversarial .deb packages or with well compressible files, placedinside a directory with permissions not allowing removal by a non-rootuser, this can end up in a DoS scenario due to causing disk quotaexhaustion or disk full conditions.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | dpkg Debian 12.15 (bookworm) | 1.21.23 | [DEBIAN-CVE-2025-6297](https://patchblox.com/security/data/fix/linux/debian-cve-2025-6297.md) | Jul 1, 2025 |
| Linux | dpkg Debian 13.5 (trixie) | 1.22.21 | [DEBIAN-CVE-2025-6297](https://patchblox.com/security/data/fix/linux/debian-cve-2025-6297.md) | Jul 1, 2025 |
| Linux | dpkg Debian 14 | 1.22.21 | [DEBIAN-CVE-2025-6297](https://patchblox.com/security/data/fix/linux/debian-cve-2025-6297.md) | Jul 1, 2025 |
| Linux | dpkg Ubuntu 22.04.1 LTS (jammy) | 1.21.1ubuntu2.6 | [dpkg 1.21.1ubuntu2.6](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-dpkg-1.21.1ubuntu2.6.md) | Jul 1, 2025 |
| Linux | dpkg Ubuntu 24.04.5 LTS (noble) | 1.22.6ubuntu6.5 | [dpkg 1.22.6ubuntu6.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-dpkg-1.22.6ubuntu6.5.md) | Jul 1, 2025 |
| Linux | dpkg Ubuntu 25.04 (plucky) | 1.22.18ubuntu2.2 | [dpkg 1.22.18ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-dpkg-1.22.18ubuntu2.2.md) | Jan 16, 2026 |
| Linux | dpkg Ubuntu 25.10 (questing) | 1.22.21ubuntu1 | [dpkg 1.22.21ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-dpkg-1.22.21ubuntu1.md) | Jul 1, 2025 |
| Linux | dpkg opensuse-leap 15.6 | 1.19.0.4-150000.4.7.1 | [SUSE-SU-2025:02734-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02734-1.md) | Aug 8, 2025 |
| Linux | dpkg sles 15.6 | 1.19.0.4-150000.4.7.1 | [SUSE-SU-2025:02734-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02734-1.md) | Aug 8, 2025 |
| Linux | dpkg sles 15.7 | 1.19.0.4-150000.4.7.1 | [SUSE-SU-2025:02734-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02734-1.md) | Aug 8, 2025 |
| Linux | dselect Ubuntu 22.04.1 LTS (jammy) | 1.21.1ubuntu2.6 | [dselect 1.21.1ubuntu2.6](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-dselect-1.21.1ubuntu2.6.md) | Jul 1, 2025 |
| Linux | dselect Ubuntu 24.04.5 LTS (noble) | 1.22.6ubuntu6.5 | [dselect 1.22.6ubuntu6.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-dselect-1.22.6ubuntu6.5.md) | Jul 1, 2025 |
| Linux | dselect Ubuntu 25.04 (plucky) | 1.22.18ubuntu2.2 | [dselect 1.22.18ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-dselect-1.22.18ubuntu2.2.md) | Jan 16, 2026 |
| Linux | dselect Ubuntu 25.10 (questing) | 1.22.21ubuntu1 | [dselect 1.22.21ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-dselect-1.22.21ubuntu1.md) | Jul 1, 2025 |
| Linux | libdpkg-perl Ubuntu 22.04.1 LTS (jammy) | 1.21.1ubuntu2.6 | [libdpkg-perl 1.21.1ubuntu2.6](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libdpkg-perl-1.21.1ubuntu2.6.md) | Jul 1, 2025 |
| Linux | libdpkg-perl Ubuntu 24.04.5 LTS (noble) | 1.22.6ubuntu6.5 | [libdpkg-perl 1.22.6ubuntu6.5](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libdpkg-perl-1.22.6ubuntu6.5.md) | Jul 1, 2025 |
| Linux | libdpkg-perl Ubuntu 25.04 (plucky) | 1.22.18ubuntu2.2 | [libdpkg-perl 1.22.18ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libdpkg-perl-1.22.18ubuntu2.2.md) | Jan 16, 2026 |
| Linux | libdpkg-perl Ubuntu 25.10 (questing) | 1.22.21ubuntu1 | [libdpkg-perl 1.22.21ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libdpkg-perl-1.22.21ubuntu1.md) | Jul 1, 2025 |
| Linux | update-alternatives opensuse-leap 15.6 | 1.19.0.4-150000.4.7.1 | [SUSE-SU-2025:02734-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02734-1.md) | Aug 8, 2025 |
| Linux | update-alternatives sles 15.6 | 1.19.0.4-150000.4.7.1 | [SUSE-SU-2025:02734-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02734-1.md) | Aug 8, 2025 |
| Linux | update-alternatives sles 15.7 | 1.19.0.4-150000.4.7.1 | [SUSE-SU-2025:02734-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02734-1.md) | Aug 8, 2025 |

---

Data as of 2026-11-09T13:31:49Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.