CVE-2025-37788

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37788
In the Linux kernel, the following vulnerability has been resolved: cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path In the for loop used to allocate the loc_array and bmap for each port, a memory leak is possible when the allocation for loc_array succeeds, but the allocation for bmap fails. This is because when the control flow goes to the label free_eth_finfo, only the allocations starting from (i-1)th iteration are freed. Fix that by freeing the loc_array in the bmap allocation error path.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/00ffb3724ce743578163f5ade2884374554ca021 Patch
https://git.kernel.org/stable/c/08aa59c0be768596467552c129e9f82166779a67 Patch
https://git.kernel.org/stable/c/118d05b530343cd9322607b9719405ba254a4183 Patch
https://git.kernel.org/stable/c/76deedea08899885f076aba0bb80bd1276446822 Patch
https://git.kernel.org/stable/c/dafb6e433ab2333b67be05433dc9c6ccbc7b1284 Patch
https://git.kernel.org/stable/c/e9de08e15aee35b96064960f95997bb6c1209c4b Patch
https://git.kernel.org/stable/c/fa2d7708955e4f8212fd69bab1da604e60cb0b15 Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

06 Nov 2025, 17:23

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/00ffb3724ce743578163f5ade2884374554ca021 - () https://git.kernel.org/stable/c/00ffb3724ce743578163f5ade2884374554ca021 - Patch
References () https://git.kernel.org/stable/c/08aa59c0be768596467552c129e9f82166779a67 - () https://git.kernel.org/stable/c/08aa59c0be768596467552c129e9f82166779a67 - Patch
References () https://git.kernel.org/stable/c/118d05b530343cd9322607b9719405ba254a4183 - () https://git.kernel.org/stable/c/118d05b530343cd9322607b9719405ba254a4183 - Patch
References () https://git.kernel.org/stable/c/76deedea08899885f076aba0bb80bd1276446822 - () https://git.kernel.org/stable/c/76deedea08899885f076aba0bb80bd1276446822 - Patch
References () https://git.kernel.org/stable/c/dafb6e433ab2333b67be05433dc9c6ccbc7b1284 - () https://git.kernel.org/stable/c/dafb6e433ab2333b67be05433dc9c6ccbc7b1284 - Patch
References () https://git.kernel.org/stable/c/e9de08e15aee35b96064960f95997bb6c1209c4b - () https://git.kernel.org/stable/c/e9de08e15aee35b96064960f95997bb6c1209c4b - Patch
References () https://git.kernel.org/stable/c/fa2d7708955e4f8212fd69bab1da604e60cb0b15 - () https://git.kernel.org/stable/c/fa2d7708955e4f8212fd69bab1da604e60cb0b15 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html - () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html - () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html - Mailing List, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401

03 Nov 2025, 20:18

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html -
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html -

02 May 2025, 13:53

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cxgb4: Se corrige la fuga de memoria en la ruta de error de cxgb4_init_ethtool_filters(). En el bucle for utilizado para asignar loc_array y bmap para cada puerto, es posible que se produzca una fuga de memoria cuando la asignación de loc_array se realiza correctamente, pero la de bmap falla. Esto se debe a que, cuando el flujo de control accede a la etiqueta free_eth_finfo, solo se liberan las asignaciones a partir de la iteración (i-1). Para solucionar esto, libere loc_array en la ruta de error de asignación de bmap.

02 May 2025, 07:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/118d05b530343cd9322607b9719405ba254a4183 -
  • () https://git.kernel.org/stable/c/e9de08e15aee35b96064960f95997bb6c1209c4b -

01 May 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 14:15

Updated : 2025-11-06 17:23

NVD link : CVE-2025-37788

Mitre link : CVE-2025-37788

CVE.ORG link : CVE-2025-37788

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime