CVE-2025-37980

What it actually does

Missing blk_mq_sysfs_unregister() call in blk_register_queue() error path after successful blk_mq_sysfs_register() causes a resource leak of sysfs structures and associated memory.

Why it matters to the business

Gradual kernel memory exhaustion on systems performing repeated block queue registrations can lead to instability, degraded performance, or crashes affecting storage and I/O operations across Linux deployments.

How an attack unfolds

A local attacker triggers block queue registration paths that succeed through blk_mq_sysfs_register() but later fail, omitting cleanup and leaking memory; repeated triggering under error conditions accumulates the leak, potentially leading to denial of service.

How to fix it

Upgrade to fixed package versions including linux 3.11.0-12.19 (Ubuntu 14.04), 4.4.0-2.16 (Ubuntu 16.04), 4.4.0-1002.2 (linux-aws 14.04), 5.15.0-1073.79~20.04.1 (linux-aws-5.15 20.04), and equivalent fixed releases for other listed variants.

How to confirm the fix worked

Confirm running kernel version matches or exceeds the listed fixed package for the distribution; review kernel source or patch history for addition of blk_mq_sysfs_unregister() in the error path of blk_register_queue().

Typical attack path

1. Gain local user access on an affected Linux system
2. Trigger block device queue registration sequences that pass blk_mq_sysfs_register() but encounter subsequent errors
3. Repeat the triggering condition to accumulate leaked resources
4. Observe or force memory pressure leading to system impact

How to detect it

Review kernel logs for block queue registration error paths; use memory leak detection tools or slabinfo to identify accumulation of sysfs-related objects tied to blk_mq; correlate with local process activity creating block devices.

What your security team should do

• Apply the listed kernel package updates on all affected Ubuntu systems without delay
• Limit unprivileged local access to reduce exposure to local-triggered leaks
• Monitor kernel memory usage and block device registration events for anomalous patterns