CVE-2025-38015

What it actually does

Memory leak in error handling path of idxd_alloc where allocated idxd structure memory is not freed before function exit on error conditions in the Linux kernel DMA engine driver.

Why it matters to the business

Over repeated error triggers, gradual memory exhaustion can degrade system performance, cause instability, or lead to denial of service on affected Linux systems; low EPSS and absence from KEV indicate limited immediate risk despite 496 days since publication.

How an attack unfolds

An attacker with local access triggers error paths during idxd device allocation repeatedly to induce the leak without direct code execution; listed threat actors appear tied to unrelated kernel privilege escalation issues rather than this specific flaw.

How to fix it

Update the Linux kernel to a version containing commit 64afd9a1f644b27661420257dcc007d5009c99dd or later; apply the fix that frees allocated memory in reverse allocation order on error paths.

How to confirm the fix worked

Confirm kernel source includes the reverse-order free calls in idxd_alloc error paths, rebuild and boot the patched kernel, then exercise error conditions to verify no leak via memory profiling tools.

Typical attack path

1. Obtain local access on a Linux system using the idxd DMA driver
2. Repeatedly invoke idxd_alloc under conditions that cause early error returns
3. Observe progressive memory consumption without corresponding release
4. Trigger system-wide resource pressure or crashes from exhaustion

How to detect it

Review kernel logs for idxd allocation failures, track process memory growth correlated with idxd driver activity, and inspect for repeated error returns in dmaengine paths; no ransomware or KEV campaigns reported.

What your security team should do

• Apply the kernel commit fix promptly on systems exposing idxd hardware
• Monitor overall system memory usage trends for unexplained growth
• Review downstream package updates where the kernel is vendored
• Harden local access controls to reduce ability to trigger allocation errors