CVE-2025-38384

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-38384
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38384.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38384
Downstream
Related
Published
2025-07-25T12:53:25.396Z
Modified
2025-11-28T02:35:30.623313Z
Summary
mtd: spinand: fix memory leak of ECC engine conf
Details

In the Linux kernel, the following vulnerability has been resolved:

mtd: spinand: fix memory leak of ECC engine conf

Memory allocated for the ECC engine conf is not released during spinand cleanup. Below kmemleak trace is seen for this memory leak:

unreferenced object 0xffffff80064f00e0 (size 8): comm "swapper/0", pid 1, jiffies 4294937458 hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace (crc 0): kmemleakalloc+0x30/0x40 _kmalloccachenoprof+0x208/0x3c0 spinandondieeccinitctx+0x114/0x200 nandeccinitctx+0x70/0xa8 nanddeveccengineinit+0xec/0x27c spinandprobe+0xa2c/0x1620 spimemprobe+0x130/0x21c spiprobe+0xf0/0x170 reallyprobe+0x17c/0x6e8 _driverprobedevice+0x17c/0x21c driverprobedevice+0x58/0x180 _deviceattachdriver+0x15c/0x1f8 busforeachdrv+0xec/0x150 _deviceattach+0x188/0x24c deviceinitialprobe+0x10/0x20 busprobedevice+0x11c/0x160

Fix the leak by calling nanddeveccenginecleanup() inside spinandcleanup().

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38384.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Fixed
68d3417305ee100dcad90fd6e5846b22497aa394
Fixed
f99408670407abb6493780e38cb4ece3fbb52cfc
Fixed
d5c1e3f32902ab518519d05515ee6030fd6c59ae
Fixed
c40b207cafd006c610832ba52a81cedee77adcb9
Fixed
93147abf80a831dd3b5660b3309b4f09546073b2
Fixed
6463cbe08b0cbf9bba8763306764f5fd643023e1

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.15.187
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.144
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.97
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.37
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.6