CVE-2025-22073

What it actually does

Failure path in spufs_new_file() called from spufs_fill_dir() leaves a negative dentry allocated without dropping it, causing a resource leak on error.

Why it matters to the business

Repeated triggering of the failure path can exhaust kernel memory or dentry cache on systems using the SPU filesystem, leading to degraded performance or crashes over time.

How an attack unfolds

An attacker with local access creates conditions that cause spufs_fill_dir() to invoke spufs_new_file() and then fail, leaving negative dentries resident; repeated attempts accumulate leaks until system resources are exhausted.

How to fix it

Update the Linux kernel to commit b1eef06d10c1a9848e3a762919bbbe315a0a7cb4 or later; for listed Red Hat packages apply python-sqlparse 0:0.4.1-2.el9ost or python3-sqlparse 0:0.4.1-2.el9ost.

How to confirm the fix worked

Verify the running kernel contains commit b1eef06d10c1a9848e3a762919bbbe315a0a7cb4; confirm package versions match the fixed releases and test spufs error paths no longer leak dentries.

Typical attack path

1. Obtain local shell or user context on an affected Linux system
2. Trigger spufs directory creation paths that exercise spufs_fill_dir()
3. Force spufs_new_file() to fail while ensuring the caller invokes spufs_rmdir()
4. Repeat to accumulate leaked negative dentries
5. Monitor for memory pressure or OOM conditions

How to detect it

Inspect kernel memory statistics and dentry cache counters for unexpected growth correlated with spufs usage; review audit logs for repeated spufs directory creation failures.

What your security team should do

• Apply the referenced kernel commit or updated packages immediately on all systems exposing spufs
• Prioritize systems with Cell/B.E. or spufs usage due to higher exposure
• Monitor memory usage and dentry cache statistics for unexplained growth
• Review local access controls to limit untrusted users from exercising spufs