CVE-2025-38419
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
25/07/2025
Last modified:
23/12/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()<br />
<br />
When rproc->state = RPROC_DETACHED and rproc_attach() is used<br />
to attach to the remote processor, if rproc_handle_resources()<br />
returns a failure, the resources allocated by imx_rproc_prepare()<br />
should be released, otherwise the following memory leak will occur.<br />
<br />
Since almost the same thing is done in imx_rproc_prepare() and<br />
rproc_resource_cleanup(), Function rproc_resource_cleanup() is able<br />
to deal with empty lists so it is better to fix the "goto" statements<br />
in rproc_attach(). replace the "unprepare_device" goto statement with<br />
"clean_up_resources" and get rid of the "unprepare_device" label.<br />
<br />
unreferenced object 0xffff0000861c5d00 (size 128):<br />
comm "kworker/u12:3", pid 59, jiffies 4294893509 (age 149.220s)<br />
hex dump (first 32 bytes):<br />
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................<br />
00 00 02 88 00 00 00 00 00 00 10 00 00 00 00 00 ............<br />
backtrace:<br />
[] slab_post_alloc_hook+0x98/0x37c<br />
[] __kmem_cache_alloc_node+0x138/0x2e0<br />
[] kmalloc_trace+0x40/0x158<br />
[] rproc_mem_entry_init+0x60/0xf8<br />
[] imx_rproc_prepare+0xe0/0x180<br />
[] rproc_boot+0x2ec/0x528<br />
[] rproc_add+0x124/0x17c<br />
[] imx_rproc_probe+0x4ec/0x5d4<br />
[] platform_probe+0x68/0xd8<br />
[] really_probe+0x110/0x27c<br />
[] __driver_probe_device+0x78/0x12c<br />
[] driver_probe_device+0x3c/0x118<br />
[] __device_attach_driver+0xb8/0xf8<br />
[] bus_for_each_drv+0x84/0xe4<br />
[] __device_attach+0xfc/0x18c<br />
[] device_initial_probe+0x14/0x20
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.13 (including) | 5.15.186 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.142 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.95 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.35 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.15.4 (excluding) |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/5434d9f2fd68722b514c14b417b53a8af02c4d24
- https://git.kernel.org/stable/c/7692c9fbedd9087dc9050903f58095915458d9b1
- https://git.kernel.org/stable/c/82208ce9505abb057afdece7c62a14687c52c9ca
- https://git.kernel.org/stable/c/92776ca0ccfe78b9bfe847af206bad641fb11121
- https://git.kernel.org/stable/c/9515d74c9d1ae7308a02e8bd4f894eb8137cf8df
- https://git.kernel.org/stable/c/c56d6ef2711ee51b54f160ad0f25a381561f0287
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html



