CVE-2025-38390

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38390
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix memory leak by freeing notifier callback node Commit e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification callbacks") adds support for notifier callbacks by allocating and inserting a callback node into a hashtable during registration of notifiers. However, during unregistration, the code only removes the node from the hashtable without freeing the associated memory, resulting in a memory leak. Resolve the memory leak issue by ensuring the allocated notifier callback node is properly freed after it is removed from the hashtable entry.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/076fa20b4f5737c34921dbb152f9efceaee571b2 Patch
https://git.kernel.org/stable/c/938827c440564b2cf2f9b804d1fe81ce8267eded Patch
https://git.kernel.org/stable/c/a833d31ad867103ba72a0b73f3606f4ab8601719 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
History

19 Nov 2025, 20:10

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/076fa20b4f5737c34921dbb152f9efceaee571b2 - () https://git.kernel.org/stable/c/076fa20b4f5737c34921dbb152f9efceaee571b2 - Patch
References () https://git.kernel.org/stable/c/938827c440564b2cf2f9b804d1fe81ce8267eded - () https://git.kernel.org/stable/c/938827c440564b2cf2f9b804d1fe81ce8267eded - Patch
References () https://git.kernel.org/stable/c/a833d31ad867103ba72a0b73f3606f4ab8601719 - () https://git.kernel.org/stable/c/a833d31ad867103ba72a0b73f3606f4ab8601719 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_ffa: Corregir fuga de memoria liberando el nodo de devolución de llamada del notificador. El commit e0573444edbf ("firmware: arm_ffa: Añadir interfaces para solicitar devoluciones de llamada de notificación") añade compatibilidad con devoluciones de llamada de notificador mediante la asignación e inserción de un nodo de devolución de llamada en una tabla hash durante el registro de notificadores. Sin embargo, al anular el registro, el código solo elimina el nodo de la tabla hash sin liberar la memoria asociada, lo que provoca una fuga de memoria. Para resolver el problema de fuga de memoria, asegúrese de que el nodo de devolución de llamada del notificador asignado se libere correctamente tras eliminarlo de la entrada de la tabla hash.
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401

25 Jul 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-25 13:15

Updated : 2025-11-19 20:10

NVD link : CVE-2025-38390

Mitre link : CVE-2025-38390

CVE.ORG link : CVE-2025-38390

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime