CVE-2025-38313 Details
Description
In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix double-free on mc_dev The blamed commit tried to simplify how the deallocations are done but, in the process, introduced a double-free on the mc_dev variable. In case the MC device is a DPRC, a new mc_bus is allocated and the mc_dev variable is just a reference to one of its fields. In this circumstance, on the error path only the mc_bus should be freed. This commit introduces back the following checkpatch warning which is a false-positive. WARNING: kfree(NULL) is safe and this check is probably not required + if (mc_bus) + kfree(mc_bus);
A double-free vulnerability has been identified in the Linux kernel's fsl-mc bus implementation. The issue arises in versions of the kernel where the mc_dev variable, which references a field of an allocated mc_bus, is improperly deallocated. This flaw occurs when the MC device is a DPRC, leading to a scenario where the mc_bus is freed, but the mc_dev reference causes a second, erroneous deallocation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/12e4431e5078847791936820bd39df9e1ee26d2e | kernel.org | Patch |
| https://git.kernel.org/stable/c/1d5baab39e5b09a76870b345cdee7933871b881f | kernel.org | Patch |
| https://git.kernel.org/stable/c/3135e03a92f6b5259d0a7f25f728e9e7866ede3f | kernel.org | Patch |
| https://git.kernel.org/stable/c/4b23c46eb2d88924b93aca647bde9a4b9cf62cf9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7002b954c4a8b9965ba0f139812ee4a6f71beac8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/873d47114fd5e5a1cad2018843671537cc71ac84 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b2057374f326303c86d8423415ab58656eebc695 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d694bf8a9acdbd061596f3e7549bc8cb70750a60 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.13, < 5.4.295 >= 5.5, < 5.10.239 >= 5.11, < 5.15.186 >= 5.16, < 6.1.142 >= 6.2, < 6.6.94 >= 6.7, < 6.12.34 >= 6.13, < 6.15.3 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 19, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Jul 10, 2025 | New CVE Received | kernel.org |