CVE-2025-38418: remoteproc: core: Release rproc->clean_table after rproc_attach() fails
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: core: Release rproc->cleantable after rprocattach() fails
When rproc->state = RPROCDETACHED is attached to remote processor through rprocattach(), if rprochandleresources() returns failure, then the clean table should be released, otherwise the following memory leak will occur.
unreferenced object 0xffff000086a99800 (size 1024): comm "kworker/u12:3", pid 59, jiffies 4294893670 (age 121.140s) hex dump (first 32 bytes): 00 00 00 00 00 80 00 00 00 00 00 00 00 00 10 00 ............ 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 ............ backtrace: [<000000008bbe4ca8>] slabpostallochook+0x98/0x3fc [<000000003b8a272b>] kmemcacheallocnode+0x13c/0x230 [<000000007a507c51>] kmallocnodetrackcaller+0x5c/0x260 [<0000000037818dae>] kmemdup+0x34/0x60 [<00000000610f7f57>] rprocboot+0x35c/0x56c [<0000000065f8871a>] rprocadd+0x124/0x17c [<00000000497416ee>] imxrprocprobe+0x4ec/0x5d4 [<000000003bcaa37d>] platformprobe+0x68/0xd8 [<00000000771577f9>] reallyprobe+0x110/0x27c [<00000000531fea59>] driverprobedevice+0x78/0x12c [<0000000080036a04>] driverprobedevice+0x3c/0x118 [<000000007e0bddcb>] deviceattachdriver+0xb8/0xf8 [<000000000cf1fa33>] busforeachdrv+0x84/0xe4 [<000000001a53b53e>] deviceattach+0xfc/0x18c [<00000000d1a2a32c>] deviceinitialprobe+0x14/0x20 [<00000000d8f8b7ae>] busprobedevice+0xb0/0xb4 unreferenced object 0xffff0000864c9690 (size 16):
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38418?
CVE-2025-38418 has a medium severity rating due to potential impacts on system stability.
How do I fix CVE-2025-38418?
To fix CVE-2025-38418, update the Linux kernel to the latest stable version that contains the patch.
What systems are affected by CVE-2025-38418?
CVE-2025-38418 affects the Linux kernel, specifically systems utilizing the remoteproc functionality.
Who is responsible for addressing CVE-2025-38418?
The Linux kernel maintainers are responsible for addressing CVE-2025-38418 by releasing updates.
What is the impact of CVE-2025-38418 on applications?
CVE-2025-38418 could lead to unexpected behavior of applications that rely on the remote processor management.