CVE-2025-38418: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38418 is a memory leak vulnerability in the Linux kernel's remoteproc subsystem, specifically in the core remote processor management code. When a remote processor in the RPROC_DETACHED state is attached via rproc_attach() and rproc_handle_resources() subsequently fails, the rproc->clean_table buffer allocated via kmemdup is not released, resulting in a kernel memory leak. The vulnerability affects Linux kernel versions 5.13–5.15.185, 5.16–6.1.141, 6.2–6.6.94, 6.7–6.12.34, and 6.13–6.15.3. It was published on July 25, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). During the rproc_boot() flow for a detached remote processor, kmemdup allocates a clean copy of the resource table into rproc->clean_table. If rproc_handle_resources() returns an error, the error-handling path fails to free this allocation before returning, leaving the memory permanently unreferenced. The backtrace in the bug report traces the leak through rproc_boot → rproc_add → imx_rproc_probe, indicating the issue is triggered during platform driver probing of i.MX remote processor devices. Exploitation requires low-privilege local access and no user interaction (Red Hat Bugzilla, Red Hat Advisory).

The primary impact is an availability degradation through gradual kernel memory exhaustion. A local attacker with low privileges could repeatedly trigger the failure condition to accumulate unreleased 1024-byte kernel slab allocations, potentially leading to resource exhaustion and system instability over time. There is no confidentiality or integrity impact; the vulnerability is confined to memory management within the remoteproc subsystem (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the practical attack surface (Red Hat Advisory).

Patches have been released for all affected kernel stable branches: upgrade to Linux kernel 5.15.186+, 6.1.142+, 6.6.95+, 6.12.35+, or 6.15.4+ as appropriate. Upstream fixes are available via the kernel stable tree (commits 3562c09, 3ee9797, 6fe9486, bcd2412, bf876fd, f4ef928). Distribution-specific updates have been issued by Ubuntu (USN-7774-1, USN-7774-2, USN-7774-5, USN-7775-1, USN-7775-2, USN-7776-1, USN-7833-1 through USN-7833-4) and SUSE (SUSE-2025-03633-1). As a workaround where patching is not immediately possible, restricting local user privileges and monitoring kernel memory usage for unexpected growth can reduce risk (Red Hat Bugzilla, Ubuntu USN-7774-1).