CVE-2025-22071

What it actually does

A reference count leak in spufs_create_context() when affinity setup triggers a failing spufs_mkdir() leaves a neighbor reference unreleased, allowing incremental resource consumption in the Linux kernel.

Why it matters to the business

Systems running affected Linux kernels, including those supporting OpenStack Ironic deployments on RHEL 9, face gradual memory pressure that can degrade performance or trigger denial-of-service conditions over time; the issue has been public for over a year with stable fixes available.

How an attack unfolds

A local attacker repeatedly calls into spufs context creation paths supplying affinity parameters that force spufs_mkdir() to fail, each time leaking a reference until kernel memory is exhausted.

How to fix it

Apply the kernel fix present in commit 829bd6139968e2e759f3928cf65ad0db1e302fe3 or upgrade the listed OpenStack Ironic packages to 1:17.1.1-17.1.20240917210749.c31db88.el9ost on RHEL 9.

How to confirm the fix worked

Confirm the running kernel contains commit 829bd6139968e2e759f3928cf65ad0db1e302fe3 or verify package versions match the fixed OpenStack Ironic releases; test context creation under failure conditions to ensure no further leaks occur.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux system
2. Invoke spufs context creation with affinity settings that cause mkdir failure
3. Repeat the operation to accumulate unreleased references
4. Trigger system-wide memory pressure or OOM conditions

How to detect it

Review kernel logs and audit records for repeated spufs context creation failures involving affinity; correlate with memory usage growth in processes interacting with the SPU filesystem.

What your security team should do

• Prioritize patching kernel and OpenStack Ironic packages to the listed fixed versions
• Monitor EPSS and KEV status for any future changes in exploit availability
• Limit unprivileged local access on systems exposing spufs until patches are deployed