CVE-2025-38409

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38409
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix another leak in the submit error path put_unused_fd() doesn't free the installed file, if we've already done fd_install(). So we need to also free the sync_file. Patchwork: https://patchwork.freedesktop.org/patch/653583/

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/00b3401f692082ddf6342500d1be25560bba46d4 Patch
https://git.kernel.org/stable/c/30d3819b0b9173e31b84d662a592af8bad351427 Patch
https://git.kernel.org/stable/c/3f6ce8433a9035b0aa810e1f5b708e9dc1c367b0 Patch
https://git.kernel.org/stable/c/c40ad1c04d306f7fde26337fdcf8a5979657d93f Patch
https://git.kernel.org/stable/c/f681c2aa8676a890eacc84044717ab0fd26e058f Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

23 Dec 2025, 19:46

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/00b3401f692082ddf6342500d1be25560bba46d4 - () https://git.kernel.org/stable/c/00b3401f692082ddf6342500d1be25560bba46d4 - Patch
References () https://git.kernel.org/stable/c/30d3819b0b9173e31b84d662a592af8bad351427 - () https://git.kernel.org/stable/c/30d3819b0b9173e31b84d662a592af8bad351427 - Patch
References () https://git.kernel.org/stable/c/3f6ce8433a9035b0aa810e1f5b708e9dc1c367b0 - () https://git.kernel.org/stable/c/3f6ce8433a9035b0aa810e1f5b708e9dc1c367b0 - Patch
References () https://git.kernel.org/stable/c/c40ad1c04d306f7fde26337fdcf8a5979657d93f - () https://git.kernel.org/stable/c/c40ad1c04d306f7fde26337fdcf8a5979657d93f - Patch
References () https://git.kernel.org/stable/c/f681c2aa8676a890eacc84044717ab0fd26e058f - () https://git.kernel.org/stable/c/f681c2aa8676a890eacc84044717ab0fd26e058f - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm: Se corrige otra fuga en la ruta de error de envío. Put_unused_fd() no libera el archivo instalado si ya se ha ejecutado fd_install(). Por lo tanto, también es necesario liberar el archivo sync_file. Patchwork: https://patchwork.freedesktop.org/patch/653583/

25 Jul 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-25 14:15

Updated : 2025-12-23 19:46

NVD link : CVE-2025-38409

Mitre link : CVE-2025-38409

CVE.ORG link : CVE-2025-38409

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime