CVE-2025-37955

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-37955
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37955.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-37955
Downstream
Published
2025-05-20T16:15:33Z
Modified
2025-06-07T05:01:31Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: free xskbuffs on error in virtnetxskpoolenable()

The selftests added to our CI by Bui Quang Minh recently reveals that there is a mem leak on the error path of virtnetxskpool_enable():

unreferenced object 0xffff88800a68a000 (size 2048): comm "xdphelper", pid 318, jiffies 4294692778 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): _kvmallocnodenoprof+0x402/0x570 virtnetxskpoolenable+0x293/0x6a0 (drivers/net/virtionet.c:5882) xpassigndev+0x369/0x670 (net/xdp/xskbuffpool.c:226) xskbind+0x6a5/0x1ae0 _sysbind+0x15e/0x230 _x64sysbind+0x72/0xb0 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.29-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}