CVE-2025-37909net: lan743x: Fix memleak issue when GSO enabled
Updated under an hour ago ()
Does this affect you?
It affects Linux and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fix memleak issue when GSO enabled Always map the `skb` to the LS descriptor. Previously skb was mapped to EXT descriptor when the number of fragments is zero with GSO enabled. Mapping the skb to EXT descriptor prevents it from being freed, leading to a memory leak
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 23f0703c125be490f70501b6b24ed5645775c56a before 093855ce90177488eac772de4eefbb909033ce5f; 23f0703c125be490f70501b6b24ed5645775c56a builds before 6c65ee5ad632eb8dcd3a91cf5dc99b22535f44d9; from 23f0703c125be490f70501b6b24ed5645775c56a before df993daa4c968b4b23078eacc248f6502ede8664; from 23f0703c125be490f70501b6b24ed5645775c56a before a0e0efbabbbe6a1859bc31bf65237ce91e124b9b; from 23f0703c125be490f70501b6b24ed5645775c56a before dae1ce27ceaea7e1522025b15252e3cc52802622; from 23f0703c125be490f70501b6b24ed5645775c56a before 189b05f189cac9fd233ef04d31cb5078c4d09c39; from 23f0703c125be490f70501b6b24ed5645775c56a before f42c18e2f14c1b1fdd2a5250069a84bc854c398c; 23f0703c125be490f70501b6b24ed5645775c56a builds before 2d52e2e38b85c8b7bc00dca55c2499f46f8c8198 | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.17 before 5.4.294; from 5.5 before 5.10.238; from 5.11 before 5.15.182; from 5.16 before 6.1.138; from 6.2 before 6.6.90; from 6.7 before 6.12.28; from 6.13 before 6.14.6; 6.15; and 3 more ranges | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
References
- https://git.kernel.org/stable/c/093855ce90177488eac772de4eefbb909033ce5fpatch
- https://git.kernel.org/stable/c/6c65ee5ad632eb8dcd3a91cf5dc99b22535f44d9patch
- https://git.kernel.org/stable/c/df993daa4c968b4b23078eacc248f6502ede8664patch
- https://git.kernel.org/stable/c/a0e0efbabbbe6a1859bc31bf65237ce91e124b9bpatch
- https://git.kernel.org/stable/c/dae1ce27ceaea7e1522025b15252e3cc52802622patch
- https://git.kernel.org/stable/c/189b05f189cac9fd233ef04d31cb5078c4d09c39patch
- https://git.kernel.org/stable/c/f42c18e2f14c1b1fdd2a5250069a84bc854c398cpatch
- https://git.kernel.org/stable/c/2d52e2e38b85c8b7bc00dca55c2499f46f8c8198patch
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.htmlmailing-list
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlmailing-list
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.