CVE-2025-6297 is a vulnerability in Debian's dpkg package management tool, specifically in the dpkg-deb utility. The flaw involves improper sanitization of directory permissions during the extraction of control members into temporary directories, which are expected to be safe even with untrusted data. This improper handling can cause temporary files to remain after cleanup, especially under repeated automated execution with adversarial .deb packages or well-compressible files located in directories where non-root users cannot remove files. The resulting accumulation of leftover files can exhaust disk quota or fill the disk, causing a denial-of-service condition. The vulnerability is rated with a CVSS 3.1 score of 8.2 (high severity) and involves CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-400 (Uncontrolled Resource Consumption). No known exploits in the wild have been reported, and no patch or remediation details are provided in the available data.

The vulnerability can lead to denial-of-service conditions by exhausting disk space or disk quota due to leftover temporary files that are not properly cleaned up. This can disrupt normal system operations, particularly on systems where dpkg-deb is executed repeatedly with crafted .deb packages or files in directories with restrictive permissions. Confidentiality and integrity impacts are low or none, but availability is significantly affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running dpkg-deb on untrusted or adversarial .deb packages in directories with restrictive permissions that prevent file removal by non-root users. Monitor for updates from Debian regarding patches or official mitigations.