CVE-2025-38444
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
25/07/2025
Last modified:
22/12/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
raid10: cleanup memleak at raid10_make_request<br />
<br />
If raid10_read_request or raid10_write_request registers a new<br />
request and the REQ_NOWAIT flag is set, the code does not<br />
free the malloc from the mempool.<br />
<br />
unreferenced object 0xffff8884802c3200 (size 192):<br />
comm "fio", pid 9197, jiffies 4298078271<br />
hex dump (first 32 bytes):<br />
00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00 .........A......<br />
08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................<br />
backtrace (crc c1a049a2):<br />
__kmalloc+0x2bb/0x450<br />
mempool_alloc+0x11b/0x320<br />
raid10_make_request+0x19e/0x650 [raid10]<br />
md_handle_request+0x3b3/0x9e0<br />
__submit_bio+0x394/0x560<br />
__submit_bio_noacct+0x145/0x530<br />
submit_bio_noacct_nocheck+0x682/0x830<br />
__blkdev_direct_IO_async+0x4dc/0x6b0<br />
blkdev_read_iter+0x1e5/0x3b0<br />
__io_read+0x230/0x1110<br />
io_read+0x13/0x30<br />
io_issue_sqe+0x134/0x1180<br />
io_submit_sqes+0x48c/0xe90<br />
__do_sys_io_uring_enter+0x574/0x8b0<br />
do_syscall_64+0x5c/0xe0<br />
entry_SYSCALL_64_after_hwframe+0x76/0x7e<br />
<br />
V4: changing backing tree to see if CKI tests will pass.<br />
The patch code has not changed between any versions.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.15.111 (including) | 5.15.189 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.17 (including) | 6.1.146 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.99 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.39 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.15.7 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/10c6021a609deb95f23f0cc2f89aa9d4bffb14c7
- https://git.kernel.org/stable/c/2941155d9a5ae098b480d551f3a5f8605d4f9af5
- https://git.kernel.org/stable/c/43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24
- https://git.kernel.org/stable/c/8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d
- https://git.kernel.org/stable/c/9af149ca9d0dab6e59e813519d309eff62499864
- https://git.kernel.org/stable/c/ed7bcd9f617e4107ac0813c516e72e6b8f6029bd
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html



