CVE-2025-37905 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2025-37905?

CVE-2025-37905 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's ARM SCMI firmware subsystem. When SCMI protocol devices are destroyed, an unbalanced device reference count prevents proper memory cleanup, leading to kernel memory exhaustion over time. This affects Linux systems using ARM SCMI firmware interfaces.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's ARM SCMI firmware subsystem. When SCMI protocol devices are destroyed, an unbalanced device reference count prevents proper memory cleanup, leading to kernel memory exhaustion over time. This affects Linux systems using ARM SCMI firmware interfaces.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions with the vulnerable ARM SCMI firmware code (specific versions not specified in CVE, but patches exist for stable branches)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using ARM SCMI firmware interfaces. Requires SCMI protocol device creation/destruction cycles to trigger.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained memory exhaustion leading to kernel panic and system crash, potentially causing denial of service and data loss.

🟠

Likely Case

Gradual memory leak during SCMI driver loading/unloading cycles, eventually causing system instability or performance degradation.

🟢

If Mitigated

Minimal impact with proper monitoring and memory limits in place, though memory consumption will still increase over time.

🌐 Internet-Facing: LOW - This is a kernel-level memory management issue requiring local access or driver manipulation.

🏢 Internal Only: MEDIUM - Local users or processes could trigger the memory leak through SCMI driver operations, potentially affecting system stability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to load/unload SCMI drivers or trigger device creation/destruction. Memory leak is gradual rather than immediate.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel branches (commits: 2fbf6c9695ad9f05e7e5c166bf43fac7cb3276b3, 8a8a3547d5c4960da053df49c75bf623827a25da, 91ff1e9652fb9beb0174267d6bb38243dff211bb, 969d8beaa2e374387bf9aa5602ef84fc50bb48d8, 9ca67840c0ddf3f39407339624cef824a4f27599)

Vendor Advisory: https://git.kernel.org/stable/c/2fbf6c9695ad9f05e7e5c166bf43fac7cb3276b3

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution's repositories. 2. Apply the specific kernel patch if building from source. 3. Reboot the system to load the new kernel.

🔧 Temporary Workarounds

Limit SCMI driver operations

linux

Restrict loading/unloading of SCMI-related drivers to reduce memory leak accumulation

echo 'blacklist scmi' >> /etc/modprobe.d/blacklist.conf
update-initramfs -u

Monitor kernel memory usage

linux

Implement monitoring for kernel memory leaks and alert on abnormal patterns

watch -n 60 'cat /proc/meminfo | grep -E "Slab|SReclaimable|SUnreclaim"'

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from loading/unloading kernel modules
Deploy kernel memory monitoring with automated alerts for memory leak patterns

🔍 How to Verify

Check if Vulnerable:

Check if system uses ARM SCMI firmware and has been loading/unloading SCMI drivers. Monitor for increasing unreclaimable slab memory in /proc/meminfo.

Check Version:

uname -r

Verify Fix Applied:

After patching, verify the kernel version includes the fix commits. Monitor memory usage during SCMI driver operations to ensure no memory leak.

📡 Detection & Monitoring

Log Indicators:

Kernel messages about memory allocation failures
System logs showing repeated SCMI device creation/destruction
Kmemleak reports of unreferenced objects at 0xffff00000f583800

Network Indicators:

None - this is a local kernel memory management issue

SIEM Query:

source="kernel" AND ("kmemleak" OR "SCMI" OR "device_find_child" OR "memory allocation failure")

📊 Metadata

CVE ID: CVE-2025-37905

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.03% exploit probability (9.3th percentile)

Published: May 20, 2025

Last Updated: November 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-37905, you might also want to check these: