Critical Memory Leak in Linux Kernel - CVE-2025-38409
Summary
CVE-2025-38409: In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix another leak in the submit error path put_unused_fd() doesn't free the installed file, if we've already done fd_install(). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It provides essential services for all other parts of the operating system, including process management, memory management, and device drivers. The kernel is crucial for system stability and performance, making it a prime target for vulnerabilities that could compromise system integrity.
Vulnerability Detail
CVE-2025-38409 is a vulnerability in the Linux kernel related to the Direct Rendering Manager (DRM) subsystem, specifically within the msm (Qualcomm's Mobile Station Modem) driver. The issue arises from a memory leak in the submit error path, where the function put_unused_fd() fails to free the installed file if fd_install() has already been executed. This oversight can lead to increased memory usage and potential denial of service as the system may exhaust available memory resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate risks.
Conclusion
CVE-2025-38409 represents a significant vulnerability in the Linux kernel that can lead to memory leaks and system instability. Users are encouraged to update their systems to the patched version to ensure protection against potential exploits. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38409 is a vulnerability in the Linux kernel that causes a memory leak in the DRM subsystem, potentially leading to system instability.
This vulnerability can lead to increased memory consumption, which may result in a denial of service if the system runs out of memory.
Versions of the Linux kernel in Debian 11, 12, and 13 are affected. It is crucial to check your current version and update if necessary.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
