Memory Leak Vulnerability in Linux Kernel - idxd_alloc Function
Summary
CVE-2025-38015: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc Memory allocated for idxd is not freed if an error occurs during idxd_alloc(). Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. The kernel is crucial for system stability and performance. This vulnerability specifically affects the idxd_alloc function within the DMA engine, which is responsible for managing Direct Memory Access operations. A memory leak in this function can lead to resource exhaustion and system instability.
Vulnerability Detail
CVE-2025-38015 is a vulnerability in the Linux kernel where memory allocated for the idxd structure is not freed if an error occurs during the idxd_alloc function. This oversight can lead to a memory leak, causing the system to consume more memory over time, potentially leading to performance degradation or system crashes. The vulnerability arises from improper error handling in the allocation process, which fails to release memory in the event of an error.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
CVE-2025-38015 is a critical memory leak vulnerability in the Linux kernel that requires immediate attention. By updating to the patched versions of the Linux package, users can mitigate the risks associated with this vulnerability. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38015 is a vulnerability in the Linux kernel that causes a memory leak in the idxd_alloc function due to improper error handling.
This vulnerability can lead to increased memory consumption, which may result in system performance issues or crashes over time.
If you are using affected versions of the Linux kernel on Debian 12 or 13, your system may be vulnerable. You can check your system's kernel version using the command 'uname -r'.
The best way to protect your system is to update the Linux package to the patched versions as soon as they are available.
Vulert is a tool that can monitor and alert you in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
