Cloud Vulnerability DB
A community-led vulnerabilities database
Introducing Wiz for Exposure Management: Unify, prioritize, and remediate exposures everywhere.
Vulnerability DatabaseCVE-2025-38390
CVE-2025-38390:
Linux Debian vulnerability analysis and mitigation
Overview
CVE-2025-38390 was discovered and disclosed on July 25, 2025, affecting the Linux kernel's firmware arm_ffa component. The vulnerability involves a memory leak issue in the notifier callback functionality (NVD, Ubuntu).
Technical details
The vulnerability stems from commit e0573444edbf which added support for notifier callbacks by allocating and inserting a callback node into a hashtable during registration of notifiers. During unregistration, the code only removes the node from the hashtable without freeing the associated memory, resulting in a memory leak. The issue specifically affects the firmware arm_ffa component (NVD, RedHat).
Impact
The vulnerability results in a memory leak condition where allocated memory for notifier callback nodes is not properly freed after being removed from the hashtable. This can lead to gradual system memory depletion over time (NVD).
Mitigation and workarounds
The issue has been resolved by ensuring the allocated notifier callback node is properly freed after it is removed from the hashtable entry. Users should update to patched versions of the Linux kernel where available (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management