CVE-2025-37983

What it actually does

Memory leak in qibfs where failure to allocate an inode leaves a dentry allocated, consuming kernel memory resources.

Why it matters to the business

Long-term resource exhaustion on systems using qibfs under memory pressure can degrade performance or trigger instability; the issue affects many legacy Ubuntu deployments and has been public for over a year with low exploit likelihood.

How an attack unfolds

An attacker would need to repeatedly induce out-of-memory conditions during inode allocation in qibfs to accumulate leaked dentries; given the low probability and lack of known in-the-wild exploitation, this is primarily a reliability concern rather than a direct attack vector, though related Linux kernel privilege-escalation campaigns have been observed in the same ecosystem.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.11.0-12.19 (14.04), 4.4.0-2.16 (16.04), 4.13.0-16.19 (18.04), 5.4.0-9.12 (20.04) and equivalent updates for linux-aws, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oracle and related meta-packages.

How to confirm the fix worked

Verify installed kernel package versions match or exceed the fixed revisions; confirm absence of repeated dentry allocation failures in kernel logs under memory stress testing on qibfs mounts.

Typical attack path

1. Mount or access a qibfs filesystem
2. Trigger allocation failure for an inode under memory pressure
3. Accumulate leaked dentries over repeated attempts
4. Observe gradual memory depletion or OOM events

How to detect it

Review kernel logs for repeated inode allocation failures paired with dentry objects; correlate with qibfs mount activity and memory pressure events; no widespread threat actor IOCs are associated with this specific leak.

What your security team should do

• Prioritize patching all listed Ubuntu 14.04/16.04/18.04/20.04 linux packages within maintenance windows
• Monitor EPSS and KEV status for any future increase in exploit maturity
• Remove or isolate qibfs usage on legacy systems where feasible