CyberSecBulletin
CVE-2025-39790NVD status: Modified

Linux: Double Free

Published Updated By the CyberSecBulletin desk

CVE-2025-39790 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 7b3f0e3b60c27f4fcb69927d84987e5fd6240530, 4079c6c59705b96285219b9efc63cab870d757b7, 5e17429679a8545afe438ce7a82a13a54e8ceabb as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 7b3f0e3b60c27f4fcb69927d84987e5fd6240530 or 4079c6c59705b96285219b9efc63cab870d757b7 or 5e17429679a8545afe438ce7a82a13a54e8ceabb or 2ec99b922f4661521927eeada76f431eebfbabc4, whichever matches your release line, or a later version.
  2. Update SIMATIC CN 4100 to V5.0 or a later version.
  3. Update Linux Kernel to 5.15.190 or 6.1.149 or 6.6.103 or 6.12.44, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1d3173a3bae7039b765a0956e3e4bf846dbaacb8 up to, but not including, 7b3f0e3b60c27f4fcb69927d84987e5fd6240530; 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 up to, but not including, 4079c6c59705b96285219b9efc63cab870d757b7; 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 up to, but not including, 5e17429679a8545afe438ce7a82a13a54e8ceabb; 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 up to, but not including, 2ec99b922f4661521927eeada76f431eebfbabc4; 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 up to, but not including, 44e1a079e18f78d6594a715b0c6d7e18c656f7b9; 1d3173a3bae7039b765a0956e3e4bf846dbaacb8 up to, but not including, 5bd398e20f0833ae8a1267d4f343591a2dd20185; 5.77b3f0e3b60c27f4fcb69927d84987e5fd6240530, 4079c6c59705b96285219b9efc63cab870d757b7, 5e17429679a8545afe438ce7a82a13a54e8ceabb, 2ec99b922f4661521927eeada76f431eebfbabc4, 44e1a079e18f78d6594a715b0c6d7e18c656f7b9, 5bd398e20f0833ae8a1267d4f343591a2dd20185
SiemensSIMATIC CN 4100before V5.0V5.0
LinuxLinux Kernel5.7 up to, but not including, 5.15.190; 5.16 up to, but not including, 6.1.149; 6.2 up to, but not including, 6.6.103; 6.7 up to, but not including, 6.12.44; 6.13 up to, but not including, 6.16.45.15.190, 6.1.149, 6.6.103, 6.12.44, 6.16.4
DebianDebian Linux11.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.18.4HighCNA
CVSS 3.17.8HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer is written")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message]

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Double Free

The product calls free() twice on the same memory address.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
  • Use a static analysis tool to find double free instances.

More Double Free vulnerabilities (CWE-415)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Double Free vulnerabilities

Spotted an error? Tell us.