CVE-2025-38417

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: fix eswitch code memory leak in reset scenario

Add simple eswitch mode checker in attaching VF procedure and allocate

required port representor memory structures only in switchdev mode.

The reset flows triggers VF (if present) detach/attach procedure.

It might involve VF port representor(s) re-creation if the device is

configured is switchdev mode (not legacy one).

The memory was blindly allocated in current implementation,

regardless of the mode and not freed if in legacy mode.

Kmemeleak trace:

unreferenced object (percpu) 0x7e3bce5b888458 (size 40):

comm "bash", pid 1784, jiffies 4295743894

hex dump (first 32 bytes on cpu 45):

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace (crc 0):

pcpu_alloc_noprof+0x4c4/0x7c0

ice_repr_create+0x66/0x130 [ice]

ice_repr_create_vf+0x22/0x70 [ice]

ice_eswi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References