製品・ソフトウェアに関する情報

JVN脆弱性詳細

Linux の Linux Kernel 等複数ベンダの製品における有効期限後のメモリの解放の欠如に関する脆弱性

Title	Linux の Linux Kernel 等複数ベンダの製品における有効期限後のメモリの解放の欠如に関する脆弱性
Summary	Linux の Linux Kernel 等複数ベンダの製品には、有効期限後のメモリの解放の欠如に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 5, 2025, midnight
Registration Date	Dec. 25, 2025, 2:43 p.m.
Last Update	Dec. 25, 2025, 2:43 p.m.

Affected System

Debian

Debian GNU/Linux 11.0

Linux

Linux Kernel 5.15.111 以上 5.15.189 未満

Linux Kernel 5.17 以上 6.1.146 未満

Linux Kernel 6.13 以上 6.15.7 未満

Linux Kernel 6.16

Linux Kernel 6.2 以上 6.6.99 未満

Linux Kernel 6.7 以上 6.12.39 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2025-38444	https://www.cve.org/CVERecord?id=CVE-2025-38444
National Vulnerability Database (NVD)
2	CVE-2025-38444	https://nvd.nist.gov/vuln/detail/CVE-2025-38444

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-401	https://cwe.mitre.org/data/definitions/401.html

ベンダー情報

No	Name	URL
Debian
1	[SECURITY] [DLA 4328-1] linux-6.1 security update	https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Kernel.org git repositories
2	raid10: cleanup memleak at raid10_make_request (10c6021)	https://git.kernel.org/stable/c/10c6021a609deb95f23f0cc2f89aa9d4bffb14c7
3	raid10: cleanup memleak at raid10_make_request (2941155)	https://git.kernel.org/stable/c/2941155d9a5ae098b480d551f3a5f8605d4f9af5
4	raid10: cleanup memleak at raid10_make_request (43806c3)	https://git.kernel.org/stable/c/43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24
5	raid10: cleanup memleak at raid10_make_request (8fc3d7b)	https://git.kernel.org/stable/c/8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d
6	raid10: cleanup memleak at raid10_make_request (9af149c)	https://git.kernel.org/stable/c/9af149ca9d0dab6e59e813519d309eff62499864
7	raid10: cleanup memleak at raid10_make_request (ed7bcd9)	https://git.kernel.org/stable/c/ed7bcd9f617e4107ac0813c516e72e6b8f6029bd
Linux Kernel
8	Linux Kernel Archives	https://www.kernel.org

Change Log

No	Changed Details	Date of change
1	[2025年12月25日] 掲載	Dec. 25, 2025, 10:46 a.m.

NVD Vulnerability Information

CVE-2025-38444

Summary	In the Linux kernel, the following vulnerability has been resolved: raid10: cleanup memleak at raid10_make_request If raid10_read_request or raid10_write_request registers a new request and the REQ_NOWAIT flag is set, the code does not free the malloc from the mempool. unreferenced object 0xffff8884802c3200 (size 192): comm "fio", pid 9197, jiffies 4298078271 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00 .........A...... 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc c1a049a2): __kmalloc+0x2bb/0x450 mempool_alloc+0x11b/0x320 raid10_make_request+0x19e/0x650 [raid10] md_handle_request+0x3b3/0x9e0 __submit_bio+0x394/0x560 __submit_bio_noacct+0x145/0x530 submit_bio_noacct_nocheck+0x682/0x830 __blkdev_direct_IO_async+0x4dc/0x6b0 blkdev_read_iter+0x1e5/0x3b0 __io_read+0x230/0x1110 io_read+0x13/0x30 io_issue_sqe+0x134/0x1180 io_submit_sqes+0x48c/0xe90 __do_sys_io_uring_enter+0x574/0x8b0 do_syscall_64+0x5c/0xe0 entry_SYSCALL_64_after_hwframe+0x76/0x7e V4: changing backing tree to see if CKI tests will pass. The patch code has not changed between any versions.
Publication Date	July 26, 2025, 1:15 a.m.
Registration Date	July 26, 2025, 4 a.m.
Last Update	July 26, 2025, 1:15 a.m.

Related information, measures and tools

No	URL	refsource	タグ
1	https://git.kernel.org/stable/c/10c6021a609deb95f23f0cc2f89aa9d4bffb14c7
2	https://git.kernel.org/stable/c/2941155d9a5ae098b480d551f3a5f8605d4f9af5
3	https://git.kernel.org/stable/c/43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24
4	https://git.kernel.org/stable/c/8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d
5	https://git.kernel.org/stable/c/9af149ca9d0dab6e59e813519d309eff62499864
6	https://git.kernel.org/stable/c/ed7bcd9f617e4107ac0813c516e72e6b8f6029bd

Common Vulnerabilities List