CVE-2025-37836: debian linux — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Found by code review. [bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/r/[email protected]]

Is your site exposed to CVE-2025-37836?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
linux	linux_kernel	4.10 — 5.10.237
linux	linux_kernel	5.11 — 5.15.181
linux	linux_kernel	5.16 — 6.1.136
linux	linux_kernel	6.2 — 6.6.89
linux	linux_kernel	6.7 — 6.12.24
linux	linux_kernel	6.13 — 6.13.12
linux	linux_kernel	6.14 — 6.14.3
debian	debian_linux	All

References

Advisories & Patches

https://git.kernel.org/stable/c/3297497ad2246eb9243849bfbbc57a0dea97d76e https://git.kernel.org/stable/c/804443c1f27883926de94c849d91f5b7d7d696e9 https://git.kernel.org/stable/c/9707d0c932f41006a2701afc926b232b50e356b4 https://git.kernel.org/stable/c/b783478e0c53ffb4f04f25fb4e21ef7f482b05df https://git.kernel.org/stable/c/bbba4c50a2d2a1d3f3bf31cc4b8280cb492bf2c7 https://git.kernel.org/stable/c/bd2a352a0d72575f1842d28c14c10089f0cfe1ae https://git.kernel.org/stable/c/f4db1b2c9ae3d013733c302ee70cac943b7070c0 https://git.kernel.org/stable/c/f9208aec86226524ec1cb68a09ac70e974ea6536

Other References

https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

Frequently Asked Questions

What is CVE-2025-37836? +

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reference leak in pci_register_host_bridge() If device_register() fails, call put_device() to give up the reference to avoid a memory leak, per the comment at device_register(). Found by code review. [bhelgaas: squash Dan Carpenter's double free fix from https://lore.kernel.org/r/[email protected]] It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2025-37836? +

CVE-2025-37836 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-37836? +

CVE-2025-37836 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-37836? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-9588 10.0

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. …

CVE-2025-57870 10.0

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This …

CVE-2026-48286 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2026-13782 10.0

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer …

CVE-2026-48303 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result …

CVE-2025-34028 10.0

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when …

CVE-2025-37836