In the Linux kernel, the following vulnerability has been resolved:
PCI: Fix reference leak in pciregisterhost_bridge()
If deviceregister() fails, call putdevice() to give up the reference to avoid a memory leak, per the comment at device_register().
Found by code review.
[bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/r/db806a6c-a91b-4e5a-a84b-6b7e01bdac85@stanley.mountain]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37836.json"
}[
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-37836-305beb3b",
"target": {
"file": "drivers/pci/probe.c",
"function": "pci_register_host_bridge"
},
"digest": {
"length": 3388.0,
"function_hash": "229367786706663959315743225598754579035"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4db1b2c9ae3d013733c302ee70cac943b7070c0"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2025-37836-4b3d084d",
"target": {
"file": "drivers/pci/probe.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117059689852259585451474477467439664436",
"42879665585498106338870131677298638818",
"185321556876656119662700348374311486969",
"236641278487630070301083138354891656318",
"66456325608777460717586795185065571349",
"98425197973678066155213263224512082620",
"234912390366574652403701465162008651167",
"312346840901870492354547307285666705704",
"241370582784666153209510602945909849832",
"212386386376001219322445527189326697249",
"226361122486333127281855090146165614206",
"336622693206157563103637888553967122972",
"100842541309659709948200643952718891372",
"1190277414277356020327004049033891166",
"123468996721526937478295928543203609982",
"170984402011596512121425648936964367241"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4db1b2c9ae3d013733c302ee70cac943b7070c0"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2025-37836-8dcda4e3",
"target": {
"file": "drivers/pci/probe.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"117059689852259585451474477467439664436",
"42879665585498106338870131677298638818",
"185321556876656119662700348374311486969",
"236641278487630070301083138354891656318",
"66456325608777460717586795185065571349",
"98425197973678066155213263224512082620",
"234912390366574652403701465162008651167",
"312346840901870492354547307285666705704",
"241370582784666153209510602945909849832",
"212386386376001219322445527189326697249",
"226361122486333127281855090146165614206",
"336622693206157563103637888553967122972",
"100842541309659709948200643952718891372",
"1190277414277356020327004049033891166",
"123468996721526937478295928543203609982",
"170984402011596512121425648936964367241"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd2a352a0d72575f1842d28c14c10089f0cfe1ae"
},
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-37836-c43c03d2",
"target": {
"file": "drivers/pci/probe.c",
"function": "pci_register_host_bridge"
},
"digest": {
"length": 3561.0,
"function_hash": "82754902644702845364254626340403111839"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd2a352a0d72575f1842d28c14c10089f0cfe1ae"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37836.json"