CVE-2025-37909

net: lan743x: Fix memleak issue when GSO enabled

Description

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fix memleak issue when GSO enabled Always map the `skb` to the LS descriptor. Previously skb was mapped to EXT descriptor when the number of fragments is zero with GSO enabled. Mapping the skb to EXT descriptor prevents it from being freed, leading to a memory leak

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/093855ce90177488eac772de4eefbb909033ce5f
https://git.kernel.org/stable/c/6c65ee5ad632eb8dcd3a91cf5dc99b22535f44d9
https://git.kernel.org/stable/c/df993daa4c968b4b23078eacc248f6502ede8664
https://git.kernel.org/stable/c/a0e0efbabbbe6a1859bc31bf65237ce91e124b9b
https://git.kernel.org/stable/c/dae1ce27ceaea7e1522025b15252e3cc52802622
https://git.kernel.org/stable/c/189b05f189cac9fd233ef04d31cb5078c4d09c39
https://git.kernel.org/stable/c/f42c18e2f14c1b1fdd2a5250069a84bc854c398c
https://git.kernel.org/stable/c/2d52e2e38b85c8b7bc00dca55c2499f46f8c8198

Frequently Asked Questions

What is the severity of CVE-2025-37909?: CVE-2025-37909 has not yet been assigned a CVSS score.
How to fix CVE-2025-37909?: To fix CVE-2025-37909, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-37909 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-37909 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-37909?: CVE-2025-37909 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.