CVE-2025-37872: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2025-37872) was discovered in the Linux kernel's txgbe driver, specifically in the txgbe_probe() error path. The vulnerability was disclosed on May 9, 2025, affecting the memory management of the network driver component (NVD, Wiz).

When txgbeswinit() is called, memory is allocated for wx->rsskey in wxinitrsskey(). However, in the txgbeprobe() function, the subsequent error paths after txgbeswinit() fail to free the rsskey. Additionally, there was a potential double-free issue for rsskey when the mactable allocation fails in wxswinit(). The vulnerability has been assigned a CVSS v3.1 base score of 5.5, indicating moderate severity (Red Hat).

The vulnerability results in a memory leak in the Linux kernel's network driver component, which could lead to system resource exhaustion over time. The impact is limited to local systems running the affected kernel versions (Red Hat).

The vulnerability has been resolved by fixing the memory leak in the error path. The fix includes properly freeing the rsskey along with wx->mactable and modifying the execution jump label when txgbeswinit() fails to prevent potential double-free issues (NVD).