CVE-2025-37836: PCI: Fix reference leak in pci_register_host_bridge()
First published: Fri May 09 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Found by code review. [bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/r/db806a6c-a91b-4e5a-a84b-6b7e01bdac85@stanley.mountain]
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/f4db1b2c9ae3d013733c302ee70cac943b7070c0
- https://git.kernel.org/stable/c/3297497ad2246eb9243849bfbbc57a0dea97d76e
- https://git.kernel.org/stable/c/b783478e0c53ffb4f04f25fb4e21ef7f482b05df
- https://git.kernel.org/stable/c/bd2a352a0d72575f1842d28c14c10089f0cfe1ae
- https://git.kernel.org/stable/c/9707d0c932f41006a2701afc926b232b50e356b4
- https://git.kernel.org/stable/c/bbba4c50a2d2a1d3f3bf31cc4b8280cb492bf2c7
- https://git.kernel.org/stable/c/f9208aec86226524ec1cb68a09ac70e974ea6536
- https://git.kernel.org/stable/c/804443c1f27883926de94c849d91f5b7d7d696e9
Frequently Asked Questions
What is the severity of CVE-2025-37836?
CVE-2025-37836 has been classified as a medium severity vulnerability due to its potential to cause a memory leak.
How do I fix CVE-2025-37836?
To fix CVE-2025-37836, ensure that you update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
Which Linux kernel versions are affected by CVE-2025-37836?
CVE-2025-37836 affects various versions of the Linux kernel, and users should check the specific versions for details on the vulnerability.
What components in the Linux kernel does CVE-2025-37836 impact?
CVE-2025-37836 impacts the PCI subsystem within the Linux kernel due to a reference leak in the pci_register_host_bridge() function.
Is CVE-2025-37836 being actively exploited?
There are no known active exploits for CVE-2025-37836 at this time, but users are encouraged to apply patches promptly.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/source
- agent/event
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux kernel