Listen to this Post
The CVE-2025-38390 vulnerability is a memory leak within the Linux kernel’s Arm FF-A (Firmware Framework for Arm) subsystem. The flaw was introduced by a commit that added notifier callback support. During the registration of a notifier, the code allocates a callback node and inserts it into a hashtable. However, the unregistration function only removes the node from the hashtable without freeing the previously allocated memory. Every time a notifier is unregistered, the kernel permanently loses track of that memory chunk. This creates a repetitive memory leak, where kernel memory is slowly exhausted over time, potentially leading to system instability or denial-of-service conditions, especially on systems that frequently register and unregister FF-A notifiers.
Platform: Linux Kernel
Version: arm_ffa module
Vulnerability: Memory Leak
Severity: Low
date: 07/25/2025
Prediction: Patch expected 07/28/2025
What Undercode Say:
Check kernel logs for allocation failures dmesg | grep -i "kernel:.alloc" Monitor kernel memory usage cat /proc/meminfo | grep Slab
// Code snippet showing the fix (freeing the node)
static void ffa_notifier_unregister(struct notifier_block nb)
{
struct ffa_notifier_callback cb;
unsigned long flags;
spin_lock_irqsave(&ffa_notifier_lock, flags);
cb = hashtable_remove(&ffa_notifier_ht, &nb->notifier_call);
spin_unlock_irqrestore(&ffa_notifier_lock, flags);
// The fix: free the memory after removal
+ kfree(cb);
}
How Exploit:
Repetitive notifier registration/unregistration calls.
Protection from this CVE
Apply kernel patch e0573444edbf.
Impact:
Kernel memory exhaustion, system instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
