# CVE-2025-38384: mtd: spinand: fix memory leak of ECC engine conf

> A memory leak in the Linux kernel's SPI NAND driver can lead to resource exhaustion and denial of service.

- **Severity:** Medium 5.5 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 25 Jul 2025
- **Updated:** 11 May 2026
- **Also known as:** AZL-65750, AZL-72397, BELL-CVE-2025-38384, DEBIAN-CVE-2025-38384, GHSA-24m9-rp8m-h4jp, ROOT-OS-DEBIAN-11-CVE-2025-38384, ROOT-OS-DEBIAN-12-CVE-2025-38384, ROOT-OS-UBUNTU-2204-CVE-2025-38384, ROOT-OS-UBUNTU-2404-CVE-2025-38384, UBUNTU-CVE-2025-38384

## What is CVE-2025-38384?

CVE-2025-38384 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

mtd: spinand: fix memory leak of ECC engine conf

Memory allocated for the ECC engine conf is not released during spinand
cleanup. Below kmemleak trace is seen for this memory leak:

unreferenced object 0xffffff80064f00e0 (size 8):
  comm "swapper/0", pid 1, jiffies 4294937458
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc+0x30/0x40
    __kmalloc_cache_noprof+0x208/0x3c0
    spinand_ondie_ecc_init_ctx+0x114/0x200
    nand_ecc_init_ctx+0x70/0xa8
    nanddev_ecc_engine_init+0xec/0x27c
    spinand_probe+0xa2c/0x1620
    spi_mem_probe+0x130/0x21c
    spi_probe+0xf0/0x170
    really_probe+0x17c/0x6e8
    __driver_probe_device+0x17c/0x21c
    driver_probe_device+0x58/0x180
    __device_attach_driver+0x15c/0x1f8
    bus_for_each_drv+0xec/0x150
    __device_attach+0x188/0x24c
    device_initial_probe+0x10/0x20
    bus_probe_device+0x11c/0x160

Fix the leak by calling nanddev_ecc_engine_cleanup() inside
spinand_cleanup().

Weakness: CWE-401 (Missing Release of Memory after Effective Lifetime)

## Which versions are affected by CVE-2025-38384?

It affects 2 products.


Products: Debian Debian Linux, Linux kernel.

## How do I fix CVE-2025-38384?

Apply the vendor's patch.

## Is CVE-2025-38384 being exploited?

There is no known exploitation of CVE-2025-38384 in the wild and no public exploit code.

## Other vulnerabilities in Debian Debian Linux

- [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild)
- [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild)
- [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-38384 and fix it if it is affected.

What it is: CVE-2025-38384 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-38384 in the wild and no public exploit code.

Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-38384/ (Markdown: https://insights.sbomify.com/CVE-2025-38384/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-38384
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-38384
- OSV: https://osv.dev/vulnerability/CVE-2025-38384

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-38384/
Summaries are generated and may contain mistakes; the official description above is the record.