CVE-2025-37836

MediumCVSS 5.5/10Last modified Nov 5, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix reference leak in pci_register_host_bridge()

If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register().

Found by code review.

[bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/r/db806a6c-a91b-4e5a-a84b-6b7e01bdac85@stanley.mountain]

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4, < f4db1b2c9ae3d013733c302ee70cac943b7070c0; >= 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4, < 3297497ad2246eb9243849bfbbc57a0dea97d76e; >= 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4, < b783478e0c53ffb4f04f25fb4e21ef7f482b05df; >= 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4, < bd2a352a0d72575f1842d28c14c10089f0cfe1ae; >= 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4, < 9707d0c932f41006a2701afc926b232b50e356b4; >= 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4, < bbba4c50a2d2a1d3f3bf31cc4b8280cb492bf2c7; >= 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4, < f9208aec86226524ec1cb68a09ac70e974ea6536; >= 37d6a0a6f4700ad3ae7bbf8db38b4557e97b3fe4, < 804443c1f27883926de94c849d91f5b7d7d696e9
LinuxLinux4.10

References

Timeline

Published
May 9, 2025
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-378375.5In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix warnings due to dmam_free_coherent() Two WARCVE-2025-378387.8In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol DriCVE-2025-378397.8In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not deterCVE-2025-37845.5Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stoCVE-2025-378407.8In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: brcmnand: fix PM resume warning Fixed warning on PM resuCVE-2025-378415.5In the Linux kernel, the following vulnerability has been resolved: pm: cpupower: bench: Prevent NULL dereference on malloc failure If malCVE-2025-378425.5In the Linux kernel, the following vulnerability has been resolved: spi: fsl-qspi: use devm function instead of driver remove Driver use dCVE-2025-378435.5In the Linux kernel, the following vulnerability has been resolved: PCI: pciehp: Avoid unnecessary device replacement check Hot-removal ofCVE-2025-378445.5In the Linux kernel, the following vulnerability has been resolved: cifs: avoid NULL pointer dereference in dbg call cifs_server_dbg() impCVE-2025-378457.8In the Linux kernel, the following vulnerability has been resolved: tracing: fprobe events: Fix possible UAF on modules Commit ac91052f0aeCVE-2025-378467.1In the Linux kernel, the following vulnerability has been resolved: arm64: mops: Do not dereference src reg for a set operation The sourceCVE-2025-378475.5In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix deadlock in ivpu_ms_cleanup() Fix deadlock in ivpu_ms_
CVE-2025-37836: Medium severity, CVSS 5.5 | Vulnix