Device Refcount Imbalance in Linux Kernel SCMI Drivers
Summary
CVE-2025-37905: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Balance device refcount when destroying devices Using device_find_child() to lookup the proper SCMI device to destroy causes an unba... Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of hardware architectures and is known for its stability and performance. However, vulnerabilities can arise, such as the one affecting the SCMI (System Control and Management Interface) drivers, which manage communication between system components. This specific vulnerability leads to improper reference counting during device destruction, potentially causing memory leaks and resource mismanagement.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the use of device_find_child() to locate the appropriate SCMI device for destruction results in an unbalanced device reference count. This occurs because device_find_child() implicitly calls get_device(), preventing the execution of the release methods for devices upon destruction. Consequently, certain structures, such as the internal struct device_private dev->p, are not freed correctly, leading to memory leaks. KMemleak can detect this issue, as loading and unloading SCMI drivers creates and destroys related devices without invoking any device_release methods.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected SCMI drivers until the patch is applied. Additionally, if you need to load the drivers, monitor the system for memory leaks and ensure that the devices are properly released after use.
Conclusion
The CVE-2025-37905 vulnerability in the Linux kernel highlights the importance of proper device reference counting in SCMI drivers. Users are encouraged to update their systems to mitigate the risk of memory leaks and ensure optimal performance. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37905 is a vulnerability in the Linux kernel related to improper device reference counting in SCMI drivers, leading to potential memory leaks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The main consequence is memory leaks due to unbalanced device reference counts, which can lead to resource exhaustion and degraded system performance.
Yes, a patch is available. Users should update their Linux package to the latest version that includes the fix for CVE-2025-37905.
If you cannot update immediately, consider avoiding the use of the affected SCMI drivers and monitor your system for any unusual behavior or memory issues.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.