CVE-2024-25740: A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->name is not released.

CVE-2024-25740 is a vulnerability in A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->name is not released., rated Moderate by Microsoft, with a CVSS 3.1 base score of 5.5 (Medium). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.21% probability of exploitation activity in the next 30 days, higher than 11% of all scored vulnerabilities. Microsoft published it on 3 September 2025 in the February 2024 Patch Tuesday. It affects 22 products in 2 product families (Open Source Software, Other).

Key facts

CVE ID

CVE-2024-25740

Severity

Medium CVSS 5.5

Microsoft severity

Moderate

Exploited in the wild

No

Publicly disclosed

No

Weakness

CWE-401

EPSS

0.21% (percentile 11%)

CISA KEV

Not listed

Released

3 September 2025

Last updated

10 August 2026

Patch Tuesday

February 2024 Patch Tuesday

Product families

Open Source Software, Other

CVSS score and vector

Microsoft scores CVE-2024-25740 at 5.5 (temporal 5.5) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Frequently asked questions (Microsoft)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Affected products (22)

Open Source Software

Other

NIST NVD data

NVD status

Modified

NVD CVSS

5.5 (MEDIUM)

NVD weakness

CWE-401

Published to NVD

12 February 2024

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://lore.kernel.org/lkml/0171b6cc-95ee-3538-913b-65a391a446b3%40huawei.com/T/ (Mailing List)
• https://lore.kernel.org/lkml/0171b6cc-95ee-3538-913b-65a391a446b3%40huawei.com/T/ (Mailing List)

Revision history

Related vulnerabilities

More from the February 2024 Patch Tuesday

• CVE-2024-21896: The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals namely Buffer.prototype.utf8Write the application can modify the result of path.resolve() which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued the permission model is an experimental feature of Node.js. (Critical, CVSS 9.8)
• CVE-2024-24577: libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add` (Critical, CVSS 9.8)
• CVE-2024-27099: Azure IoT Platform Device SDK Double Free Vulnerability (Critical, CVSS 9.8)
• CVE-2024-27319: Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy. (Critical, CVSS 9.1)
• CVE-2024-21891: Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued the permission model is an experimental feature of Node.js. (High, CVSS 8.8)
• CVE-2024-25744: In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c. (High, CVSS 8.8)
• CVE-2024-23807: Apache Xerces C++: Use-after-free on external DTD scan (High, CVSS 8.1)
• CVE-2024-25710: Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file (High, CVSS 8.1)
• CVE-2024-0985: PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL (High, CVSS 8)
• CVE-2022-48624: close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (High, CVSS 7.8)
• CVE-2023-46045: Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root. (High, CVSS 7.8)
• CVE-2023-52452: bpf: Fix accesses to uninit stack slots (High, CVSS 7.8)

All vulnerabilities of this release: February 2024 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2024-25740
• NIST NVD: CVE-2024-25740
• CVE.org record: CVE-2024-25740