🛡️ CVE-2025-38384 — debian-linux

🟡 CVSS 5.5 — Medium ✅ No Known Exploit CWE-401 NVD
5.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

mtd: spinand: fix memory leak of ECC engine conf

In the Linux kernel, the following vulnerability has been resolved:

mtd: spinand: fix memory leak of ECC engine conf

Memory allocated for the ECC engine conf is not released during spinand

cleanup. Below kmemleak trace is seen for this memory leak:

unreferenced object 0xffffff80064f00e0 (size 8):

comm "swapper/0", pid 1, jiffies 4294937458

hex dump (first 8 bytes):

00 00 00 00 00 00 00 00 ........

backtrace (crc 0):

kmemleak_alloc+0x30/0x40

__kmalloc_cache_noprof+0x208/0x3c0

spinand_ondie_ecc_init_ctx+0x114/0x200

nand_ecc_init_ctx+0x70/0xa8

nanddev_ecc_engine_init+0xec/0x27c

spinand_probe+0xa2c/0x1620

spi_mem_probe+0x130/0x21c

spi_probe+0xf0/0x170

really_probe+0x17c/0x6e8

__driver_probe_device+0x17c/0x21c

driver_probe_device+0x58/0x180

__device_attach_driver+0x15c/0x1f8

bus_for_each_drv+0xec/0x150

__device_attach+0x188/0x24c

device_initial_probe+0x10/0x20

bus_probe_device+0x11c/0x160

Fix the leak by calling nanddev_ecc_engine_cleanup() inside

spinand_cleanup().

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.

Weakness class

CVE-2025-38384 is classified as CWE-401: Memory Leak. Allocated memory is never released, so long-running or repeated operations gradually exhaust it.

Affected software

CVE-2025-38384 is recorded against 3 packages.

  • debian-linux
  • kernel (from 6.13.0 up to 6.15.6)
  • linux-kernel

Timeline and source

Published on 25 July 2025 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
git.kernel.org
lists.debian.org

CVE-2025-38384 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity MEDIUM
CVSS Score 5.5
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE CWE-401
Public Exploit ✅ No
Source NVD
Published 2025-07-25
Updated 2026-08-12
Modified 2026-06-17

Affected Packages

Software From version Fixed in
debian-linux — —
kernel 6.13.0 6.15.6
linux-kernel — —

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in debian-linux

CVE-2025-38384 is rated CVSS 5.5 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.