Memory Leak Vulnerability in Linux Kernel: virtio-net Package Affected
Summary
DEBIAN-CVE-2025-37955: In the Linux kernel, the following vulnerability has been resolved: virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() The selftests added to our CI by Bui Quang Minh recently reveals that there is a mem le... Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. The virtio-net package is a virtual network driver that allows efficient communication between virtual machines and the host system. This package is crucial for network performance in virtualized environments, but it is susceptible to vulnerabilities that can lead to memory leaks and system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the virtio-net package, specifically in the function virtnet_xsk_pool_enable(). During error handling, the function fails to free allocated memory for xsk_buffs, leading to a memory leak. This issue was revealed through self-tests added to the continuous integration (CI) system. The unreferenced object, which is a memory allocation of size 2048, remains in memory, potentially causing resource exhaustion and affecting system performance. The backtrace indicates the flow of execution leading to the error, highlighting the critical nature of this vulnerability.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
The memory leak vulnerability in the virtio-net package of the Linux kernel poses a significant risk to system performance and stability. It is crucial to update to the patched version 6.12.29-1 to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The memory leak can lead to resource exhaustion, causing system slowdowns or crashes, particularly in environments with limited memory resources.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While the primary concern is resource exhaustion, there is no direct indication that this vulnerability leads to data loss. However, system instability could indirectly affect data integrity.
If an immediate update is not possible, monitor your system closely for performance issues and consider isolating affected services until the patch can be applied.
Detailed information about this vulnerability can be found in the CVE database and through the Debian security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
