SB20250520122 - Memory leak in Linux kernel firmware arm_scmi driver
Published: May 20, 2025 Updated: May 21, 2025
Security Bulletin ID
SB20250520122
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Memory leak (CVE-ID: CVE-2025-37905)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the scmi_child_dev_find() function in drivers/firmware/arm_scmi/bus.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/2fbf6c9695ad9f05e7e5c166bf43fac7cb3276b3
- https://git.kernel.org/stable/c/8a8a3547d5c4960da053df49c75bf623827a25da
- https://git.kernel.org/stable/c/91ff1e9652fb9beb0174267d6bb38243dff211bb
- https://git.kernel.org/stable/c/969d8beaa2e374387bf9aa5602ef84fc50bb48d8
- https://git.kernel.org/stable/c/9ca67840c0ddf3f39407339624cef824a4f27599
- https://git.kernel.org/stable/c/ff4273d47da81b95ed9396110bcbd1b7b7470fe8
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.138