CVE-2025-37909

MEDIUM

Linux Kernel 4.17-6.14.5 - Use-After-Free in LAN743x GSO Descriptor Mapping

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fix memleak issue when GSO enabled Always map the `skb` to the LS descriptor. Previously skb was mapped to EXT descriptor when the number of fragments is zero with GSO enabled. Mapping the skb to EXT descriptor prevents it from being freed, leading to a memory leak

References (10)

Core 10

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html

Mailing List

https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Patch

https://git.kernel.org/stable/c/093855ce90177488eac772de4eefbb909033ce5f

Patch

https://git.kernel.org/stable/c/6c65ee5ad632eb8dcd3a91cf5dc99b22535f44d9

Patch

https://git.kernel.org/stable/c/df993daa4c968b4b23078eacc248f6502ede8664

Patch

https://git.kernel.org/stable/c/a0e0efbabbbe6a1859bc31bf65237ce91e124b9b

Patch

https://git.kernel.org/stable/c/dae1ce27ceaea7e1522025b15252e3cc52802622

Patch

https://git.kernel.org/stable/c/189b05f189cac9fd233ef04d31cb5078c4d09c39

Patch

https://git.kernel.org/stable/c/f42c18e2f14c1b1fdd2a5250069a84bc854c398c

Patch

https://git.kernel.org/stable/c/2d52e2e38b85c8b7bc00dca55c2499f46f8c8198

Scores

CVSS v3 5.5

EPSS 0.0017

EPSS Percentile 6.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-401

Status published

Products (28)

debian/debian_linux 11.0

linux/Kernel 4.17.0 - 5.4.294linux

linux/Kernel 5.11.0 - 5.15.182linux

linux/Kernel 5.16.0 - 6.1.138linux

linux/Kernel 5.5.0 - 5.10.238linux

linux/Kernel 6.13.0 - 6.14.6linux

linux/Kernel 6.2.0 - 6.6.90linux

linux/Kernel 6.7.0 - 6.12.28linux

Linux/Linux < 4.17

Linux/Linux 23f0703c125be490f70501b6b24ed5645775c56a - 093855ce90177488eac772de4eefbb909033ce5f

... and 18 more

Published May 20, 2025

Tracked Since Feb 18, 2026