Kernel Oops Vulnerability in Linux Package: PCI Endpoint Double Free Issue
Summary
CVE-2025-38069: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops Fix a kernel oops found while testing the stm32_pcie Endpoint driver with handli... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. The vulnerability in question affects the PCI endpoint framework, specifically the pci-epf-test driver, which is used for testing PCI Express endpoints. This vulnerability can lead to system instability and crashes if not addressed.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the PCI endpoint framework where a double free condition can occur during the handling of the PERST# deassertion. This issue arises during the initialization of the endpoint when the function pci_epf_test_alloc_space() allocates all Base Address Registers (BARs). If the function epc_set_bar() fails, the allocated memory is freed, but the pointer to the BAR remains non-NULL. Upon reboot, this can lead to a double free situation, causing a kernel oops, which can destabilize the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workaround is provided for this vulnerability. However, users are advised to avoid rebooting the system while the vulnerability is present until a patch is applied.
Conclusion
The CVE-2025-38069 vulnerability in the Linux kernel's PCI endpoint framework poses a significant risk of system instability due to a double free condition. Users are encouraged to apply the available patch promptly to mitigate this risk and ensure system reliability.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a double free issue in the PCI endpoint framework of the Linux kernel, which can lead to kernel crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability can cause system instability, crashes, and potential data loss.
Yes, a patch is available for Debian 13 in version 6.12.32-1. Users should update their systems to this version.
If you cannot apply the patch, avoid rebooting your system to prevent triggering the double free condition.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
