CVE-2025-37989 – A memory leak vulnerability in the Linux kernel... (How to Fix)

Q: What is the severity of CVE-2025-37989?

CVE-2025-37989 has a CVSS score of 5.5 (MEDIUM). A memory leak vulnerability in the Linux kernel's PHY LED trigger code can cause out-of-memory conditions during network restarts. This affects Linux systems with network interfaces using PHY LED triggers, potentially leading to system instability or denial of service. The vulnerability stems from improper use of devm memory management APIs.

📋 TL;DR

A memory leak vulnerability in the Linux kernel's PHY LED trigger code can cause out-of-memory conditions during network restarts. This affects Linux systems with network interfaces using PHY LED triggers, potentially leading to system instability or denial of service. The vulnerability stems from improper use of devm memory management APIs.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions containing the vulnerable PHY LED trigger code (specific version range depends on distribution backports)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires PHY LED triggers to be enabled and network interfaces using them. Many embedded devices and routers are particularly vulnerable due to frequent network restarts.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Repeated network restarts could exhaust system memory, causing kernel panic, system crashes, or complete denial of service.

🟠

Likely Case

Gradual memory consumption during network interface operations leading to performance degradation and potential service interruptions.

🟢

If Mitigated

Minimal impact with proper monitoring and memory limits, though eventual memory exhaustion remains possible with sufficient triggers.

🌐 Internet-Facing: LOW - Requires local network interface operations, not directly exploitable from remote networks.

🏢 Internal Only: MEDIUM - Can be triggered by legitimate network operations or malicious local users with network restart capabilities.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: LOW - Simply triggering network restarts can exploit the vulnerability.

Exploitation requires ability to restart network interfaces, which typically requires local access or specific privileges.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel commits: 41143e71052a00d654c15dc924fda50c1e7357d0, 618541a6cc1511064dfa58c89b3445e21844092f, 663c3da86e807c6c07ed48f911c7526fad6fe1ff, 7f3d5880800f962c347777c4f8358f29f5fc403c, 95bed65cc0eb2a610550abf849a8b94374da80a7

Vendor Advisory: https://git.kernel.org/stable/c/41143e71052a00d654c15dc924fda50c1e7357d0

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for backported patches. 3. Reboot the system after kernel update. 4. Verify the fix is applied by checking kernel version or examining the PHY LED trigger code.

🔧 Temporary Workarounds

Disable PHY LED triggers

linux

Prevent the vulnerable code from being executed by disabling PHY LED triggers

echo 0 > /sys/class/leds/*/trigger
modprobe -r phylib (if possible)
Disable LED triggers in kernel configuration if rebuilding

Limit network restart frequency

linux

Reduce exposure by minimizing network interface restarts

Configure network services to minimize restarts
Implement rate limiting on network management operations

🧯 If You Can't Patch

Implement memory monitoring and alerts for unusual consumption patterns
Restrict network management capabilities to trusted users only

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if PHY LED triggers are enabled: lsmod | grep phy, check /sys/class/leds/*/trigger for phy* entries

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits: uname -r, check distribution security advisories for specific patch inclusion

📡 Detection & Monitoring

Log Indicators:

Kernel OOM (Out of Memory) messages in dmesg
Increasing memory usage in system logs during network operations
PHY-related errors in kernel logs

Network Indicators:

Unusual network interface restart patterns
Increased system memory consumption correlated with network events

SIEM Query:

source="kernel" AND ("out of memory" OR "OOM" OR "slab" OR "kmem") AND ("phy" OR "led" OR "network")

📊 Metadata

CVE ID: CVE-2025-37989

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

EPSS Score: 0.03% exploit probability (6.2th percentile)

Published: May 20, 2025

Last Updated: December 16, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-37989, you might also want to check these: