CVE-2025-37989

What it actually does

Misuse of devm API in PHY LED trigger code allows repeated register/unregister calls on attach/detach without freeing kzalloc memory until driver unbind, resulting in undetected leaks.

Why it matters to the business

Repeated network restarts on routers and Linux-based network devices can exhaust system memory, causing instability, degraded performance, or outages in high-availability network environments.

How an attack unfolds

An attacker triggers repeated PHY attach and detach sequences through network interface manipulation or restarts; memory accumulates across cycles because devm allocations persist, leading to OOM. Advanced spyware campaigns and actors chaining Linux kernel privilege escalation flaws may leverage this for denial-of-service or to facilitate further exploitation.

How to fix it

Upgrade the Linux kernel to a version containing commit 966d6494e2ed9be9052fcd9815afba830896aaf8, replacing devm_kzalloc/devm_kcalloc with kzalloc/kcalloc and adding corresponding kfree calls in the unregister path.

How to confirm the fix worked

Confirm the patch is present by inspecting phy_led_triggers_register for kzalloc usage and phy_led_triggers_unregister for kfree; re-run network restart tests to verify absence of memory growth.

Typical attack path

1. Gain ability to trigger network restarts or PHY attach/detach on target Linux system
2. Repeatedly cycle network interfaces or PHY devices
3. Observe progressive kernel memory consumption bypassing kmemleak detection
4. Induce out-of-memory condition affecting system stability

How to detect it

Review kernel logs for OOM killer activity tied to network PHY subsystems; correlate repeated phy_attach_direct and phy_detach events with rising slab or kmalloc usage; examine threat actor patterns from advanced spyware or related kernel escalation campaigns for similar memory exhaustion attempts.

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all affected systems due to 526 days since publication
• Restrict unnecessary network restart operations in production environments
• Incorporate PHY LED trigger memory accounting into routine kernel leak monitoring