CVE-2025-38409 — Missing Release of Memory after Effective Lifetime in Linux
CWE-401 — Missing Release of Memory after Effective LifetimeCWE-362 — Race Condition50 documents8 sources
Severity
5.5MEDIUMNVD
OSV5.6OSV3.2
EPSS
0.0%
top 93.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 25
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Fix another leak in the submit error path
put_unused_fd() doesn't free the installed file, if we've already done
fd_install(). So we need to also free the sync_file.
Patchwork: https://patchwork.freedesktop.org/patch/653583/
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 — 00b3401f692082ddf6342500d1be25560bba46d4+5
Also affects: Debian Linux 11.0