Linux: Double Free
CVE-2025-38069 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions e2e43854ab72a9d4908ac2bf6087f80aa138a8b5, 761db4ca3a469f2070757acd4e104dff5125ca99, fe2329eff5bee461ebcafadb6ca1df0cbf5945fd as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to e2e43854ab72a9d4908ac2bf6087f80aa138a8b5 or 761db4ca3a469f2070757acd4e104dff5125ca99 or fe2329eff5bee461ebcafadb6ca1df0cbf5945fd or 8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.12.31 or 6.14.9, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 349e7a85b25fa6ee82902d9be2cc5f3bec815120 up to, but not including, e2e43854ab72a9d4908ac2bf6087f80aa138a8b5; 349e7a85b25fa6ee82902d9be2cc5f3bec815120 up to, but not including, 761db4ca3a469f2070757acd4e104dff5125ca99; 349e7a85b25fa6ee82902d9be2cc5f3bec815120 up to, but not including, fe2329eff5bee461ebcafadb6ca1df0cbf5945fd; 349e7a85b25fa6ee82902d9be2cc5f3bec815120 up to, but not including, 8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee; 349e7a85b25fa6ee82902d9be2cc5f3bec815120 up to, but not including, 934e9d137d937706004c325fa1474f9e3f1ba10a; 4.12 | e2e43854ab72a9d4908ac2bf6087f80aa138a8b5, 761db4ca3a469f2070757acd4e104dff5125ca99, fe2329eff5bee461ebcafadb6ca1df0cbf5945fd, 8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee, 934e9d137d937706004c325fa1474f9e3f1ba10a |
| Linux | Linux Kernel | before 6.12.31; 6.13 up to, but not including, 6.14.9 | 6.12.31, 6.14.9 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops Fix a kernel oops found while testing the stm32_pcie Endpoint driver with handling of PERST# deassertion: During EP initialization, pci_epf_test_alloc_space() allocates all BARs, which are further freed if epc_set_bar() fails (for instance, due to no free inbound window). However, when pci_epc_set_bar() fails, the error path: pci_epc_set_bar() -> pci_epf_free_space() does not clear the previous assignment to epf_test->reg[bar]. Then, if the host reboots, the PERST# deassertion restarts the BAR allocation sequence with the same allocation failure (no free inbound window), creating a double free situation since epf_test->reg[bar] was deallocated and is still non-NULL. Thus, make sure that pci_epf_alloc_space() and pci_epf_free_space() invocations are symmetric, and as such, set epf_test->reg[bar] to NULL when memory is freed. [kwilczynski: commit log]
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other references
Recent Double Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
- 7.5 High severity
Spotted an error? Tell us.