CVE-2025-38384

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-38384
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38384.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38384
Downstream
Related
Published
2025-07-25T13:15:27Z
Modified
2025-08-12T21:01:38Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

mtd: spinand: fix memory leak of ECC engine conf

Memory allocated for the ECC engine conf is not released during spinand cleanup. Below kmemleak trace is seen for this memory leak:

unreferenced object 0xffffff80064f00e0 (size 8): comm "swapper/0", pid 1, jiffies 4294937458 hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace (crc 0): kmemleakalloc+0x30/0x40 _kmalloccachenoprof+0x208/0x3c0 spinandondieeccinitctx+0x114/0x200 nandeccinitctx+0x70/0xa8 nanddeveccengineinit+0xec/0x27c spinandprobe+0xa2c/0x1620 spimemprobe+0x130/0x21c spiprobe+0xf0/0x170 reallyprobe+0x17c/0x6e8 _driverprobedevice+0x17c/0x21c driverprobedevice+0x58/0x180 _deviceattachdriver+0x15c/0x1f8 busforeachdrv+0xec/0x150 _deviceattach+0x188/0x24c deviceinitialprobe+0x10/0x20 busprobedevice+0x11c/0x160

Fix the leak by calling nanddeveccenginecleanup() inside spinandcleanup().

References

Affected packages