Memory Leak Vulnerability in Linux Kernel: linux Package Affected
Summary
DEBIAN-CVE-2025-37941: In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe() When snd_soc_dapm_new_controls() or snd_soc_dapm_add_routes() fails, wcd... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for enabling communication between software applications and the underlying hardware. This package is critical for system stability and performance, making it a prime target for vulnerabilities that could compromise system integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ASoC (ALSA System on Chip) subsystem, specifically within the wcd937x codec driver. The issue arises in the function wcd937x_soc_codec_probe(), where a potential memory leak occurs if the functions snd_soc_dapm_new_controls() or snd_soc_dapm_add_routes() fail. In such cases, the function returns without releasing the memory allocated for 'wcd937x->clsh_info', leading to resource wastage and potential system instability. This vulnerability could be exploited to degrade system performance over time due to memory exhaustion.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
In summary, the vulnerability identified in the Linux kernel's ASoC subsystem poses a risk of memory leaks, which can affect system performance. It is crucial to update the linux package to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a memory leak in the Linux kernel's ASoC subsystem, specifically in the wcd937x codec driver.
If exploited, this vulnerability can lead to increased memory usage, potentially causing system slowdowns or crashes over time.
Yes, a patch is available in the form of an updated package version 6.12.25-1.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities in real-time.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
