openEuler 22.03 LTS SP3 update for kernel



Risk Low
Patch available YES
Number of vulnerabilities 13
CVE-ID CVE-2022-3238
CVE-2022-49781
CVE-2022-49784
CVE-2023-53061
CVE-2023-53073
CVE-2023-53146
CVE-2024-57876
CVE-2024-58097
CVE-2025-37773
CVE-2025-37782
CVE-2025-37925
CVE-2025-37940
CVE-2025-37980
CWE-ID CWE-415
CWE-476
CWE-401
CWE-388
CWE-667
CWE-835
CWE-20
CWE-125
Exploitation vector Local
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-headers
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 13 vulnerabilities.

1) Double free

EUVDB-ID: #VU92739

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3238

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

A double-free flaw was found in the Linux kernel's NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU108278

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49781

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the amd_pmu_handle_irq() function in arch/x86/events/amd/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU108193

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49784

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the uncore_clean_online() function in arch/x86/events/amd/uncore.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU108417

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-53061

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the smb2_open() function in fs/ksmbd/smb2pdu.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper error handling

EUVDB-ID: #VU108489

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-53073

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the amd_pmu_v2_handle_irq() function in arch/x86/events/amd/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU109254

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-53146

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dw2102_i2c_transfer() function in drivers/media/usb/dvb-usb/dw2102.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper locking

EUVDB-ID: #VU102936

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57876

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the drm_dp_mst_topology_mgr_set_mst(), EXPORT_SYMBOL(), update_msg_rx_state() and drm_dp_mst_hpd_irq_handle_event() functions in drivers/gpu/drm/display/drm_dp_mst_topology.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Infinite loop

EUVDB-ID: #VU107762

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58097

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the ath11k_dp_rx_mon_mpdu_pop() and ath11k_dp_rx_full_mon_mpdu_pop() functions in drivers/net/wireless/ath/ath11k/dp_rx.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU108388

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37773

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the virtio_fs_get_tree() function in fs/fuse/virtio_fs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds read

EUVDB-ID: #VU108254

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37782

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the hfs_bnode_read_key() function in fs/hfsplus/bnode.c, within the hfs_bnode_read_key() function in fs/hfs/bnode.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper locking

EUVDB-ID: #VU107734

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37925

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the duplicateIXtree() function in fs/jfs/jfs_imap.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper locking

EUVDB-ID: #VU109531

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37940

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ftrace_graph_set_hash() function in kernel/trace/ftrace.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Memory leak

EUVDB-ID: #VU109489

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37980

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the blk_debugfs_remove() function in block/blk-sysfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP3

python3-perf-debuginfo: before 5.10.0-265.0.0.167

python3-perf: before 5.10.0-265.0.0.167

perf-debuginfo: before 5.10.0-265.0.0.167

perf: before 5.10.0-265.0.0.167

kernel-tools-devel: before 5.10.0-265.0.0.167

kernel-tools-debuginfo: before 5.10.0-265.0.0.167

kernel-tools: before 5.10.0-265.0.0.167

kernel-source: before 5.10.0-265.0.0.167

kernel-headers: before 5.10.0-265.0.0.167

kernel-devel: before 5.10.0-265.0.0.167

kernel-debugsource: before 5.10.0-265.0.0.167

kernel-debuginfo: before 5.10.0-265.0.0.167

kernel: before 5.10.0-265.0.0.167

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1570


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###