CVE-2025-37909

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37909

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fix memleak issue when GSO enabled Always map the `skb` to the LS descriptor. Previously skb was mapped to EXT descriptor when the number of fragments is zero with GSO enabled. Mapping the skb to EXT descriptor prevents it from being freed, leading to a memory leak

References
Link Resource
https://git.kernel.org/stable/c/093855ce90177488eac772de4eefbb909033ce5f Patch
https://git.kernel.org/stable/c/189b05f189cac9fd233ef04d31cb5078c4d09c39 Patch
https://git.kernel.org/stable/c/2d52e2e38b85c8b7bc00dca55c2499f46f8c8198 Patch
https://git.kernel.org/stable/c/6c65ee5ad632eb8dcd3a91cf5dc99b22535f44d9 Patch
https://git.kernel.org/stable/c/a0e0efbabbbe6a1859bc31bf65237ce91e124b9b Patch
https://git.kernel.org/stable/c/dae1ce27ceaea7e1522025b15252e3cc52802622 Patch
https://git.kernel.org/stable/c/df993daa4c968b4b23078eacc248f6502ede8664 Patch
https://git.kernel.org/stable/c/f42c18e2f14c1b1fdd2a5250069a84bc854c398c Patch
https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

17 Nov 2025, 14:51

Type Values Removed Values Added
First Time Debian
Linux linux Kernel
Debian debian Linux
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/093855ce90177488eac772de4eefbb909033ce5f - () https://git.kernel.org/stable/c/093855ce90177488eac772de4eefbb909033ce5f - Patch
References () https://git.kernel.org/stable/c/189b05f189cac9fd233ef04d31cb5078c4d09c39 - () https://git.kernel.org/stable/c/189b05f189cac9fd233ef04d31cb5078c4d09c39 - Patch
References () https://git.kernel.org/stable/c/2d52e2e38b85c8b7bc00dca55c2499f46f8c8198 - () https://git.kernel.org/stable/c/2d52e2e38b85c8b7bc00dca55c2499f46f8c8198 - Patch
References () https://git.kernel.org/stable/c/6c65ee5ad632eb8dcd3a91cf5dc99b22535f44d9 - () https://git.kernel.org/stable/c/6c65ee5ad632eb8dcd3a91cf5dc99b22535f44d9 - Patch
References () https://git.kernel.org/stable/c/a0e0efbabbbe6a1859bc31bf65237ce91e124b9b - () https://git.kernel.org/stable/c/a0e0efbabbbe6a1859bc31bf65237ce91e124b9b - Patch
References () https://git.kernel.org/stable/c/dae1ce27ceaea7e1522025b15252e3cc52802622 - () https://git.kernel.org/stable/c/dae1ce27ceaea7e1522025b15252e3cc52802622 - Patch
References () https://git.kernel.org/stable/c/df993daa4c968b4b23078eacc248f6502ede8664 - () https://git.kernel.org/stable/c/df993daa4c968b4b23078eacc248f6502ede8664 - Patch
References () https://git.kernel.org/stable/c/f42c18e2f14c1b1fdd2a5250069a84bc854c398c - () https://git.kernel.org/stable/c/f42c18e2f14c1b1fdd2a5250069a84bc854c398c - Patch
References () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html - Mailing List
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Mailing List
CWE CWE-401

03 Nov 2025, 20:18

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html -

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -

04 Jun 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/093855ce90177488eac772de4eefbb909033ce5f -
  • () https://git.kernel.org/stable/c/6c65ee5ad632eb8dcd3a91cf5dc99b22535f44d9 -

21 May 2025, 20:25

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: lan743x: Se solucionó el problema de fuga de memoria con GSO habilitado. Siempre se asigna `skb` al descriptor LS. Anteriormente, skb se asignaba al descriptor EXT cuando el número de fragmentos era cero con GSO habilitado. Asignar skb al descriptor EXT impide su liberación, lo que provoca una fuga de memoria.

20 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-20 16:15

Updated : 2025-11-17 14:51

NVD link : CVE-2025-37909

Mitre link : CVE-2025-37909

CVE.ORG link : CVE-2025-37909

JSON object : View

Products Affected

linux

debian

CWE
CWE-401

Missing Release of Memory after Effective Lifetime