CVE-2025-38419: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: core: Cleanup acquired resources when rprochandleresources() fails in rprocattach()
When rproc->state = RPROCDETACHED and rprocattach() is used to attach to the remote processor, if rprochandleresources() returns a failure, the resources allocated by imxrprocprepare() should be released, otherwise the following memory leak will occur.
Since almost the same thing is done in imxrprocprepare() and rprocresourcecleanup(), Function rprocresourcecleanup() is able to deal with empty lists so it is better to fix the "goto" statements in rprocattach(). replace the "unpreparedevice" goto statement with "cleanupresources" and get rid of the "unpreparedevice" label.
unreferenced object 0xffff0000861c5d00 (size 128): comm "kworker/u12:3", pid 59, jiffies 4294893509 (age 149.220s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 02 88 00 00 00 00 00 00 10 00 00 00 00 00 ............ backtrace: [<00000000f949fe18>] slabpostallochook+0x98/0x37c [<00000000adbfb3e7>] kmemcacheallocnode+0x138/0x2e0 [<00000000521c0345>] kmalloctrace+0x40/0x158 [<000000004e330a49>] rprocmementryinit+0x60/0xf8 [<000000002815755e>] imxrprocprepare+0xe0/0x180 [<0000000003f61b4e>] rprocboot+0x2ec/0x528 [<00000000e7e994ac>] rprocadd+0x124/0x17c [<0000000048594076>] imxrprocprobe+0x4ec/0x5d4 [<00000000efc298a1>] platformprobe+0x68/0xd8 [<00000000110be6fe>] reallyprobe+0x110/0x27c [<00000000e245c0ae>] driverprobedevice+0x78/0x12c [<00000000f61f6f5e>] driverprobedevice+0x3c/0x118 [<00000000a7874938>] deviceattachdriver+0xb8/0xf8 [<0000000065319e69>] busforeachdrv+0x84/0xe4 [<00000000db3eb243>] deviceattach+0xfc/0x18c [<0000000072e4e1a4>] deviceinitialprobe+0x14/0x20
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel remoteproc core, update rproc_attach() to replace the "unprepare_device" goto statement with "clean_up_resources" and remove the "unprepare_device" label, ensuring resources are cleaned up when rproc_handle_resources() fails.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38419?
CVE-2025-38419 is classified as medium severity due to its impact on the Linux kernel's handling of remote processor attachments.
How do I fix CVE-2025-38419?
To mitigate CVE-2025-38419, upgrade to the patched version of the Linux kernel that resolves the vulnerability.
Is my system affected by CVE-2025-38419?
Systems running affected versions of the Linux kernel that utilize remote processors are vulnerable to CVE-2025-38419.
What are the implications of CVE-2025-38419?
CVE-2025-38419 can lead to resource leaks in the Linux kernel, potentially affecting system performance and reliability.
When was CVE-2025-38419 reported?
CVE-2025-38419 was reported in 2025, highlighting an issue in the Linux kernel's remote processor handling.