PT-2025-16749 · Linux+3 · Linux Kernel+3
Published
2025-03-24
·
Updated
2026-05-26
·
CVE-2025-22109
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to the fixed version
Description
A memory leak issue has been identified in the Linux kernel, specifically in the ax25 module. The problem occurs when using the autobind feature to bind an AX25 socket, leading to memory leaks in
ax25 connect() and refcount leaks in ax25 release(). This issue was detected using kmemleak and reported by Syzkaller. The autobind feature has been removed as it was considered broken and prone to various memory bugs. As a result, calling connect() without first binding the socket will now result in an error.Recommendations
For Linux kernel versions prior to the fixed version, consider updating to a newer version that includes the fix for this issue.
As a temporary workaround, consider disabling the autobind feature for AX25 sockets to prevent memory leaks.
Restrict access to the
ax25 connect() function to minimize the risk of exploitation.
Avoid using the connect() function without first binding the socket to prevent errors.Exploit
Fix
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linux Kernel
Suse
Ubuntu