Memory Leak Vulnerability in Linux Kernel: linux Package Affected
Summary
DEBIAN-CVE-2025-38390: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix memory leak by freeing notifier callback node Commit e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification cal... Affects linux versions < 6.12.37-1. Fixed in 6.12.37-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is crucial for the overall functionality and performance of the system. The vulnerability in question arises from a flaw in the firmware handling within the kernel, specifically related to the management of notifier callbacks, which are used for asynchronous notifications in various subsystems.
Vulnerability Detail
In the Linux kernel, a memory leak vulnerability has been identified due to improper handling of notifier callback nodes. When a notifier is unregistered, the associated memory allocated for the callback node is not freed, leading to a gradual increase in memory usage. This issue originates from commit e0573444edbf, which introduced support for notifier callbacks but failed to implement proper memory management during unregistration. The ramifications of this vulnerability include potential system instability and increased memory consumption, which could affect performance over time.
How To Fix
Minimum fixed version
6.12.37-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the patch. Users are advised to monitor their system's memory usage and apply the update as soon as it becomes available.
Conclusion
The identified memory leak vulnerability in the Linux kernel's linux package poses a risk of increased memory usage and potential system instability. Users are strongly encouraged to update to the patched version 6.12.37-1 to mitigate this issue. Regular monitoring and updates are essential for maintaining system security and performance.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a memory leak in the Linux kernel related to notifier callback management, which can lead to increased memory usage over time.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to analyze your manifest file for vulnerabilities.
The main impact is increased memory consumption, which may lead to system instability and degraded performance if not addressed.
Yes, a patch is available in version 6.12.37-1 of the linux package. Users should update to this version to resolve the issue.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file. It provides real-time alerts without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
