CVE-2025-37872: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2025-37872) was discovered in the Linux kernel's txgbe driver, specifically in the txgbe_probe() error path. The vulnerability was disclosed on May 9, 2025, affecting the memory management of the network driver component (NVD, Wiz).

When txgbe_sw_init() is called, memory is allocated for wx->rss_key in wx_init_rss_key(). However, in the txgbe_probe() function, the subsequent error paths after txgbe_sw_init() fail to free the rss_key. Additionally, there was a potential double-free issue for rss_key when the mac_table allocation fails in wx_sw_init(). The vulnerability has been assigned a CVSS v3.1 base score of 5.5, indicating moderate severity (Red Hat).

The vulnerability results in a memory leak in the Linux kernel's network driver component, which could lead to system resource exhaustion over time. The impact is limited to local systems running the affected kernel versions (Red Hat).

The vulnerability has been resolved by fixing the memory leak in the error path. The fix includes properly freeing the rss_key along with wx->mac_table and modifying the execution jump label when txgbe_sw_init() fails to prevent potential double-free issues (NVD).