Gang Directory Lifetime Leak in Linux Kernel - CVE-2025-22072
Summary
CVE-2025-22072: In the Linux kernel, the following vulnerability has been resolved: spufs: fix gang directory lifetimes prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gan... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system and is known for its stability, performance, and security. However, vulnerabilities can arise, such as CVE-2025-22072, which affects the spufs (Secure Processing Unit File System) component, leading to potential resource leaks and system instability.
Vulnerability Detail
CVE-2025-22072 is a vulnerability in the Linux kernel's spufs that involves improper handling of gang directory lifetimes. When a gang is created, it returns an opened gang directory that should be removed upon closure. However, if a context belonging to that gang is kept alive, the removal fails, leading to a resource leak. The initial fix was incorrectly implemented, resulting in unbalanced reference counts and potential memory leaks. This vulnerability can lead to degraded system performance and resource exhaustion.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2025-22072 is a significant vulnerability in the Linux kernel's spufs that can lead to resource leaks and system instability. It is crucial for users to update their systems to the patched version to mitigate risks associated with this vulnerability. Monitoring tools like Vulert can help keep track of vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22072 is a vulnerability in the Linux kernel's spufs that can lead to resource leaks due to improper handling of gang directory lifetimes.
This vulnerability can lead to degraded system performance and potential resource exhaustion, impacting the stability of applications relying on the Linux kernel.
You should update your Linux kernel to the patched version that resolves CVE-2025-22072 as soon as it is available.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Detailed information about CVE-2025-22072 can be found in the official Linux kernel documentation and vulnerability databases.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
