First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-38409

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix another leak in the submit error path

put_unused_fd() doesn't free the installed file, if we've already done fd_install(). So we need to also free the sync_file.

Patchwork: https://patchwork.freedesktop.org/patch/653583/

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Linux	Linux	>= 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300, < 00b3401f692082ddf6342500d1be25560bba46d4; >= 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300, < c40ad1c04d306f7fde26337fdcf8a5979657d93f; >= 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300, < 3f6ce8433a9035b0aa810e1f5b708e9dc1c367b0; >= 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300, < 30d3819b0b9173e31b84d662a592af8bad351427; >= 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300, < f681c2aa8676a890eacc84044717ab0fd26e058f
Linux	Linux	3.12

References

Timeline

Published: Jul 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-38419.8A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This af CVE-2025-384105.5In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix a fence leak in submit error path In error paths, we coul CVE-2025-384117.8In the Linux kernel, the following vulnerability has been resolved: netfs: Fix double put of request If a netfs request finishes during th CVE-2025-384125.5In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs ca CVE-2025-384135.5In the Linux kernel, the following vulnerability has been resolved: virtio-net: xsk: rx: fix the frame's length check When calling buf_to_CVE-2025-384145.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 GCC_GCC_CVE-2025-384157.8In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an CVE-2025-384167.8In the Linux kernel, the following vulnerability has been resolved: NFC: nci: uart: Set tty->disc_data only in success path Setting tty->d CVE-2025-384175.5In the Linux kernel, the following vulnerability has been resolved: ice: fix eswitch code memory leak in reset scenario Add simple eswitch CVE-2025-384185.5In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Release rproc->clean_table after rproc_attach() fails CVE-2025-384195.5In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Cleanup acquired resources when rproc_handle_resource CVE-2025-38429.8A vulnerability was found in panhainan DS-Java 1.0 and classified as critical. This issue affects the function uploadUserPic.action of the f

CVE-2025-38409: Medium severity, CVSS 5.5 | Vulnix