CVE-2025-38384: mtd: spinand: fix memory leak of ECC engine conf
In the Linux kernel, the following vulnerability has been resolved:
mtd: spinand: fix memory leak of ECC engine conf
Memory allocated for the ECC engine conf is not released during spinand cleanup. Below kmemleak trace is seen for this memory leak:
unreferenced object 0xffffff80064f00e0 (size 8): comm "swapper/0", pid 1, jiffies 4294937458 hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace (crc 0): kmemleakalloc+0x30/0x40 kmalloccachenoprof+0x208/0x3c0 spinandondieeccinitctx+0x114/0x200 nandeccinitctx+0x70/0xa8 nanddeveccengineinit+0xec/0x27c spinandprobe+0xa2c/0x1620 spimemprobe+0x130/0x21c spiprobe+0xf0/0x170 reallyprobe+0x17c/0x6e8 driverprobedevice+0x17c/0x21c driverprobedevice+0x58/0x180 deviceattachdriver+0x15c/0x1f8 busforeachdrv+0xec/0x150 deviceattach+0x188/0x24c deviceinitialprobe+0x10/0x20 busprobedevice+0x11c/0x160
Fix the leak by calling nanddeveccenginecleanup() inside spinandcleanup().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel mtd spinand driver, call nanddev_ecc_engine_cleanup() inside spinand_cleanup() to release the ECC engine configuration and fix the memory leak.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38384?
CVE-2025-38384 has a medium severity level due to its impact on memory management in the Linux kernel.
What causes CVE-2025-38384?
CVE-2025-38384 is caused by a memory leak in the ECC engine configuration during the spinand cleanup process in the Linux kernel.
How do I fix CVE-2025-38384?
To fix CVE-2025-38384, it is recommended to update your Linux kernel to the latest version where the memory leak has been resolved.
Which versions of the Linux kernel are affected by CVE-2025-38384?
CVE-2025-38384 affects multiple versions of the Linux kernel that utilize the spinand memory management features.
Is CVE-2025-38384 a critical vulnerability?
CVE-2025-38384 is not classified as a critical vulnerability, but it can lead to potential memory issues if left unaddressed.