CVE-2025-37980

The vulnerability is a resource leak in the Linux kernel’s blk_register_queue error path. When a block queue registration succeeds through blk_mq_sysfs_register() but a later error occurs, the previously created sysfs resources are not removed, causing kernel memory to be consumed over time. This is a classic example of CWE-401 Unreleased Resource. The leak may allow an attacker to trigger repeated errors and eventually exhaust kernel memory, leading to a denial of service. The likely attack vector is any code path that registers block queues in the kernel, such as a custom block driver. The description states the missing cleanup, and it is inferred that repeated exploitation would accumulate unreleased memory until exhaustion.

All Linux kernel builds prior to the fix, notably the 6.15 release candidates 1 and 2 and any earlier releases, are affected. Updating to a kernel version that includes commit 40f2eb9b5315 resolves the issue.

The CVSS score of 5.5 indicates moderate impact. The EPSS score of less than 1% suggests low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The error path requires the ability to invoke blk_register_queue, which normally necessitates privileged kernel code or a custom module; therefore a local attacker with elevated privileges or an existing module could exploit it. No publicly known exploit is available. Based on the description, it is inferred that a local privileged attacker could repeatedly trigger the error path to exhaust kernel memory and cause a denial of service.