| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025050914-CVE-2025-37836-5ccf@gregkh> Date: Fri, 9 May 2025 08:42:15 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-37836: PCI: Fix reference leak in pci_register_host_bridge() From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Found by code review. [bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/r/db806a6c-a91b-4e5a-a84b-6b7e01bdac85@stanley.mountain] The Linux kernel CVE team has assigned CVE-2025-37836 to this issue. Affected and fixed versions =========================== Issue introduced in 4.10 with commit 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4 and fixed in 5.10.237 with commit f4db1b2c9ae3d013733c302ee70cac943b7070c0 Issue introduced in 4.10 with commit 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4 and fixed in 5.15.181 with commit 3297497ad2246eb9243849bfbbc57a0dea97d76e Issue introduced in 4.10 with commit 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4 and fixed in 6.1.136 with commit b783478e0c53ffb4f04f25fb4e21ef7f482b05df Issue introduced in 4.10 with commit 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4 and fixed in 6.6.89 with commit bd2a352a0d72575f1842d28c14c10089f0cfe1ae Issue introduced in 4.10 with commit 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4 and fixed in 6.12.24 with commit 9707d0c932f41006a2701afc926b232b50e356b4 Issue introduced in 4.10 with commit 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4 and fixed in 6.13.12 with commit bbba4c50a2d2a1d3f3bf31cc4b8280cb492bf2c7 Issue introduced in 4.10 with commit 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4 and fixed in 6.14.3 with commit f9208aec86226524ec1cb68a09ac70e974ea6536 Issue introduced in 4.10 with commit 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4 and fixed in 6.15-rc1 with commit 804443c1f27883926de94c849d91f5b7d7d696e9 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-37836 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/pci/probe.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f4db1b2c9ae3d013733c302ee70cac943b7070c0 https://git.kernel.org/stable/c/3297497ad2246eb9243849bfbbc57a0dea97d76e https://git.kernel.org/stable/c/b783478e0c53ffb4f04f25fb4e21ef7f482b05df https://git.kernel.org/stable/c/bd2a352a0d72575f1842d28c14c10089f0cfe1ae https://git.kernel.org/stable/c/9707d0c932f41006a2701afc926b232b50e356b4 https://git.kernel.org/stable/c/bbba4c50a2d2a1d3f3bf31cc4b8280cb492bf2c7 https://git.kernel.org/stable/c/f9208aec86226524ec1cb68a09ac70e974ea6536 https://git.kernel.org/stable/c/804443c1f27883926de94c849d91f5b7d7d696e9
Powered by blists - more mailing lists