CVE-2025-37955: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2025-37955) was discovered in the Linux kernel's virtio-net component, specifically in the virtnetxskpool_enable() function. The vulnerability was identified through selftests added to the continuous integration (CI) system by Bui Quang Minh and was disclosed on May 20, 2025 (NVD, Wiz).

The vulnerability manifests as a memory leak in the error path of virtnetxskpoolenable(). When an error occurs, the function fails to properly free xskbuffs, resulting in an unreferenced object of size 2048 bytes. The issue was confirmed through memory analysis showing the leaked object at address 0xffff88800a68a000, associated with the 'xdp_helper' process (PID 318). The vulnerability has been assigned a CVSS v3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) (RedHat).

The vulnerability results in memory leakage, which could lead to resource exhaustion over time. While the immediate impact per instance is relatively small (2048 bytes), repeated triggers of this error condition could accumulate to cause system performance degradation (Wiz).

The vulnerability has been resolved in the Linux kernel through patches that properly free xskbuffs on the error path of virtnetxskpoolenable(). Users should update to the patched version of the kernel when it becomes available (Wiz).