{"id":"CVE-2025-37989","title":"net: phy: leds: fix memory leak","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: leds: fix memory leak\n\nA network restart test on a router led to an out-of-memory condition,\nwhich was traced to a memory leak in the PHY LED trigger code.\n\nT…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 966d6494e2ed9be9052fcd9815afba830896aaf8","Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 95bed65cc0eb2a610550abf849a8b94374da80a7","Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 663c3da86e807c6c07ed48f911c7526fad6fe1ff","Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < f41f097f68a33d392579885426d0734a81219501","Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 618541a6cc1511064dfa58c89b3445e21844092f","Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 41143e71052a00d654c15dc924fda50c1e7357d0","Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 7f3d5880800f962c347777c4f8358f29f5fc403c","Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < b7f0ee992adf601aa00c252418266177eb7ac2bc","Linux 4.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:47:30.722543Z"},"published":"2025-05-20","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:52:11.045Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-37989","references":[{"url":"https://git.kernel.org/stable/c/966d6494e2ed9be9052fcd9815afba830896aaf8"},{"url":"https://git.kernel.org/stable/c/95bed65cc0eb2a610550abf849a8b94374da80a7"},{"url":"https://git.kernel.org/stable/c/663c3da86e807c6c07ed48f911c7526fad6fe1ff"},{"url":"https://git.kernel.org/stable/c/f41f097f68a33d392579885426d0734a81219501"},{"url":"https://git.kernel.org/stable/c/618541a6cc1511064dfa58c89b3445e21844092f"},{"url":"https://git.kernel.org/stable/c/41143e71052a00d654c15dc924fda50c1e7357d0"},{"url":"https://git.kernel.org/stable/c/7f3d5880800f962c347777c4f8358f29f5fc403c"},{"url":"https://git.kernel.org/stable/c/b7f0ee992adf601aa00c252418266177eb7ac2bc"}],"tags":["cve.org"],"epss":0.00198,"epssPercentile":0.09668,"ingestedAt":"2026-11-05T22:38:31.903Z","slug":"CVE-2025-37989","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: leds: fix memory leak\n\nA network restart test on a router led to an out-of-memory condition,\nwhich was traced to a memory leak in the PHY LED trigger code.\n\nThe root cause is misuse of the devm API. The registration function\n(phy_led_triggers_register) is called from phy_attach_direct, not\nphy_probe, and the unregister function (phy_led_triggers_unregister)\nis called from phy_detach, not phy_remove. This means the register and\nunregister functions can be called multiple times for the same PHY\ndevice, but devm-allocated memory is not freed until the driver is\nunbound.\n\nThis also prevents kmemleak from detecting the leak, as the devm API\ninternally stores the allocated pointer.\n\nFix this by replacing devm_kzalloc/devm_kcalloc with standard\nkzalloc/kcalloc, and add the corresponding kfree calls in the unregister\npath.\n\n## Affected\n\n- `Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 966d6494e2ed9be9052fcd9815afba830896aaf8`\n- `Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 95bed65cc0eb2a610550abf849a8b94374da80a7`\n- `Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 663c3da86e807c6c07ed48f911c7526fad6fe1ff`\n- `Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < f41f097f68a33d392579885426d0734a81219501`\n- `Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 618541a6cc1511064dfa58c89b3445e21844092f`\n- `Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 41143e71052a00d654c15dc924fda50c1e7357d0`\n- `Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < 7f3d5880800f962c347777c4f8358f29f5fc403c`\n- `Linux >= 2e0bc452f4721520502575362a9cd3c1248d2337 < b7f0ee992adf601aa00c252418266177eb7ac2bc`\n- `Linux 4.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}