Memory Leak in Linux Kernel Remote Procedure Handling

CVE-2025-38419

What is CVE-2025-38419?

A vulnerability exists in the Linux kernel's remote procedure handling that may lead to a memory leak. Specifically, when the rproc_attach() function is called while the remote processor state is RPROC_DETACHED, a failure in rproc_handle_resources() does not trigger the release of resources allocated during rproc_attach(). This oversight can lead to unreferenced objects persisting in memory, ultimately causing a leak. The fix involves refining the control flow to ensure that the resource cleanup process is invoked correctly under failure conditions, preventing unnecessary resource occupation.

References