CVE-2024-25740: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2024-25740) was discovered in the Linux kernel through version 6.7.4. The flaw specifically affects the UBI driver located in drivers/mtd/ubi/attach.c when processing UBI_IOCATT operations, where kobj->name is not properly released (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The issue is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The technical root cause stems from a failure to release the kobj->name resource in the UBI driver's attach functionality (NVD).

The memory leak can lead to resource exhaustion over time, potentially affecting system availability. Since it's a local attack vector with low complexity and requires low privileges, the primary impact is on system resources rather than confidentiality or integrity (NVD).

The vulnerability requires local access and low privileges to exploit. It can be triggered through the UBI_IOCATT operation in the UBI driver. The issue was discovered during testing with Syzkaller, a kernel fuzzing tool (Kernel Mailing List).

A fix has been developed and included in Linux kernel version 6.13-rc1. Users are advised to update their systems to a patched version when available. The fix addresses the memory leak by properly releasing the kobj->name resource (Debian Tracker).