PT-2025-22272 · Linux+5 · Linux Kernel+5
Published
2025-04-17
·
Updated
2026-04-20
·
CVE-2025-37989
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A memory leak was discovered in the PHY LED trigger code of the Linux kernel. The issue was identified during a network restart test on a router, which led to an out-of-memory condition. The root cause is the misuse of the devm API, where the registration and unregister functions can be called multiple times for the same PHY device, but devm-allocated memory is not freed until the driver is unbound. This also prevents kmemleak from detecting the leak. The issue is related to the
phy led triggers register and phy led triggers unregister functions.Recommendations
To resolve the issue, replace devm kzalloc/devm kcalloc with standard kzalloc/kcalloc, and add the corresponding kfree calls in the unregister path.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu