SB2025050961 - Memory leak in Linux kernel arm64 kvm
Published: May 9, 2025 Updated: May 10, 2025
Security Bulletin ID
SB2025050961
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Memory leak (CVE-ID: CVE-2025-37849)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the kvm_arch_vcpu_create() function in arch/arm64/kvm/arm.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/07476e0d932afc53c05468076393ac35d0b4999e
- https://git.kernel.org/stable/c/2480326eba8ae9ccc5e4c3c2dc8d407db68e3c52
- https://git.kernel.org/stable/c/250f25367b58d8c65a1b060a2dda037eea09a672
- https://git.kernel.org/stable/c/5085e02362b9948f82fceca979b8f8e12acb1cc5
- https://git.kernel.org/stable/c/c322789613407647a05ff5c451a7bf545fb34e73
- https://git.kernel.org/stable/c/f1e9087abaeedec9bf2894a282ee4f0d8383f299
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14.3