CVE-2025-37905

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Balance device refcount when destroying devices

Using device_find_child() to lookup the proper SCMI device to destroy

causes an unbalance in device refcount, since device_find_child() calls an

implicit get_device(): this, in turns, inhibits the call of the provided

release methods upon devices destruction.

As a consequence, one of the structures that is not freed properly upon

destruction is the internal struct device_private dev->p populated by the

drivers subsystem core.

KMemleak detects this situation since loading/unloding some SCMI driver

causes related devices to be created/destroyed without calling any

device_release method.

unreferenced object 0xffff00000f583800 (size 512):

comm "insmod", pid 227, jiffies 4294912190

hex dump (first 32 bytes):

00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........

ff ff ff ff ff ff ff ff 60 36 1d 8a 00 80 ff ff ........`6......

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References