Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2025-38699: Linux kernel: Freeing memory twice can crash the system
CVE-2025-38699
Summary
A bug in the Linux kernel can cause a critical system component to crash if it fails to initialize properly. This can happen when a driver is installed or uninstalled. To fix this issue, the kernel has been updated to set a specific value to NULL when initialization fails, preventing the double-free error.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| linux | linux_kernel |
>= 2.6.33, < 5.4.297 >= 5.5, < 5.10.241 >= 5.11, < 5.15.190 >= 5.16, < 6.1.149 >= 6.2, < 6.6.103 >= 6.7, < 6.12.43 >= 6.13, < 6.15.11 >= 6.16, < 6.16.2 2.6.32 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| debian | debian_linux |
11.0 cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
Original title
In the Linux kernel, the following vulnerability has been resolved:
scsi: bfa: Double-free fix
When the bfad_im_probe() function fails during initialization, the memory
pointed to by bfad->im is ...
Original description
In the Linux kernel, the following vulnerability has been resolved:
scsi: bfa: Double-free fix
When the bfad_im_probe() function fails during initialization, the memory
pointed to by bfad->im is freed without setting bfad->im to NULL.
Subsequently, during driver uninstallation, when the state machine enters
the bfad_sm_stopping state and calls the bfad_im_probe_undo() function,
it attempts to free the memory pointed to by bfad->im again, thereby
triggering a double-free vulnerability.
Set bfad->im to NULL if probing fails.
scsi: bfa: Double-free fix
When the bfad_im_probe() function fails during initialization, the memory
pointed to by bfad->im is freed without setting bfad->im to NULL.
Subsequently, during driver uninstallation, when the state machine enters
the bfad_sm_stopping state and calls the bfad_im_probe_undo() function,
it attempts to free the memory pointed to by bfad->im again, thereby
triggering a double-free vulnerability.
Set bfad->im to NULL if probing fails.
nvd CVSS3.1
7.8
Vulnerability type
CWE-415
- https://git.kernel.org/stable/c/13f613228cf3c96a038424cd97aa4d6aadc66294 Patch
- https://git.kernel.org/stable/c/39cfe2c83146aad956318f866d0ee471b7a61fa5 Patch
- https://git.kernel.org/stable/c/50d9bd48321038bd6e15af5a454bbcd180cf6f80 Patch
- https://git.kernel.org/stable/c/684c92bb08a25ed3c0356bc7eb532ed5b19588dd Patch
- https://git.kernel.org/stable/c/8456f862cb95bcc3a831e1ba87c0c17068be0f3f Patch
- https://git.kernel.org/stable/c/8e03dd9fadf76db5b9799583074a1a2a54f787f1 Patch
- https://git.kernel.org/stable/c/9337c2affbaebe00b75fdf84ea0e2fcf93c140af Patch
- https://git.kernel.org/stable/c/add4c4850363d7c1b72e8fce9ccb21fdd2cf5dc9 Patch
- https://git.kernel.org/stable/c/ba024d92564580bb90ec367248ace8efe16ce815 Patch
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Published: 4 Sep 2025 · Updated: 15 Jun 2026 · First seen: 7 Mar 2026