Kernel Vulnerability in Linux Packages: Memory Leak in SPU File System
Summary
CVE-2025-22073: In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak on spufs_new_file() failure It's called from spufs_fill_dir(), and caller of that will do spufs_rmdir() in case of failure. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of functionalities, including process management, memory management, and device control. The SPU file system (spufs) is a specialized file system used for managing SPU (Synergistic Processing Unit) resources in Linux. This vulnerability affects various Debian versions of the Linux kernel, potentially compromising system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SPU file system (spufs) where a memory leak occurs during the failure of the spufs_new_file() function. This function is invoked by spufs_fill_dir(), and upon failure, the caller is expected to invoke spufs_rmdir() to clean up. However, while this process removes the created resources, the problematic dentry remains negative, leading to a memory leak. This issue can result in increased memory usage and potential denial of service if not addressed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as they are released.
Conclusion
The CVE-2025-22073 vulnerability in the Linux kernel's SPU file system poses a significant risk due to memory leaks during file creation failures. It is crucial for users to update their systems to the latest patched versions to mitigate this risk and maintain system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22073 is a vulnerability in the Linux kernel's SPU file system that leads to a memory leak during file creation failures.
The vulnerability affects Debian versions 11, 12, and 13 of the Linux kernel.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability can lead to increased memory usage, system instability, and potential denial of service.
Yes, users are advised to update their Linux packages to the latest version to apply the necessary patches.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
