LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37757: tipc: fix memory leak in tipc_link_xmit

In the Linux kernel, the following vulnerability has been resolved: tipc: fix memory leak in tipc_link_xmit In case the backlog transmit queue for system-importance messages is overloaded, tipc_link_xmit() returns -ENOBUFS but the skb list is not purged. This leads to memory leak and failure when a skb is allocated. This commit fixes this issue by purging the skb list before tipc_link_xmit() returns.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux TIPC networking can leak kernel memory when an important-message transmit queue is overloaded. Continued leakage may exhaust resources and disrupt services. Risk is concentrated on systems where TIPC is enabled and operational; the supplied evidence does not establish that every Linux host is practically exposed.

Executive priority

Treat this as an expedited availability patch for TIPC-dependent or exposed infrastructure, especially highly available clusters and network services. Ordinary Linux hosts without operational TIPC are lower priority pending validation. Initiate incident response only if monitoring shows unexplained memory exhaustion or related service disruption.

Technical view

When tipc_link_xmit() returns -ENOBUFS for an overloaded system-importance backlog, it fails to purge the remaining socket-buffer list. Repeated failures can leak memory until new buffer allocation fails. The upstream correction purges that list before returning. The supplied CVSS 3.1 score is 7.5, reflecting network-reachable, unauthenticated availability impact.

Likely exposure

Potentially exposed assets are Linux systems running an affected kernel with TIPC enabled, configured, or network-reachable. The supplied version records span multiple kernel lines but do not clearly define every vulnerable and fixed package boundary. Distribution kernel versions must therefore be mapped through vendor advisories or confirmation that the relevant stable fix was incorporated.

Exploitation context

The supplied record is not in KEV, and none of the cited sources establishes active exploitation or a public exploit. The documented failure condition requires an overloaded TIPC backlog for system-importance messages. Evidence supports denial-of-service risk through memory exhaustion, not confidentiality loss, integrity compromise, or code execution.

Researcher notes

The defect is a resource-lifecycle error on the -ENOBUFS return path: queued sk_buffs remain unpurged. Stable commits add cleanup before return. The bundle does not establish exact triggering volume, module-loading prerequisites, recovery behavior, exploit reliability, or complete distribution-specific fixed-version boundaries; those points require vendor or source-level confirmation.

Mitigation direction

  • Install a vendor-supported kernel containing the branch-appropriate upstream fix.
  • Consult distribution guidance to identify the corrected package for each kernel line.
  • Disable unused TIPC where operationally safe and consistent with vendor guidance.
  • Restrict TIPC network exposure while affected systems await maintenance.

Validation and detection

  • Inventory kernel versions and identify systems where TIPC is enabled, loaded, configured, or reachable.
  • Map distribution package versions to vendor advisories and the relevant upstream stable commits.
  • Confirm the deployed kernel includes the branch-appropriate skb-list purge fix.
  • Monitor affected nodes for memory pressure, allocation failures, TIPC errors, and service instability.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37757 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
12Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2025-37757Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux365ad353c2564bba8835290061308ba825166b3a, 365ad353c2564bba8835290061308ba825166b3a, 365ad353c2564bba8835290061308ba825166b3a, 365ad353c2564bba8835290061308ba825166b3a, 365ad353c2564bba8835290061308ba825166b3a, 365ad353c2564bba8835290061308ba825166b3a, 365ad353c2564bba8835290061308ba825166b3a, 365ad353c2564bba8835290061308ba825166b3a, 365ad353c2564bba8835290061308ba825166b3aunaffected
LinuxLinux4.11, 0, 5.4.293, 5.10.237, 5.15.181, 6.1.135, 6.6.88, 6.12.24, 6.13.12, 6.14.3, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.