Double-Free Vulnerability in Linux Kernel - Impacting Debian Linux Packages
Summary
CVE-2025-38699: In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfa... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various distributions, including Debian. The kernel's stability and security are critical, as vulnerabilities can lead to system crashes or unauthorized access. This specific vulnerability affects the SCSI driver, which is responsible for managing SCSI devices, and arises from improper memory management during the initialization process.
Vulnerability Detail
In the Linux kernel, a double-free vulnerability has been identified in the SCSI driver related to the bfad_im_probe() function. When initialization fails, the memory allocated to bfad->im is freed but not set to NULL. This oversight leads to a situation where, during driver uninstallation, the memory is attempted to be freed again, resulting in a double-free condition. Such vulnerabilities can be exploited to cause system instability, crashes, or even arbitrary code execution, posing significant security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as they are released.
Conclusion
The double-free vulnerability in the Linux kernel poses significant risks to systems running affected Debian packages. It is crucial to apply the necessary updates to ensure system security and stability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
A double-free vulnerability occurs when a program attempts to free the same memory location more than once, which can lead to memory corruption and potential exploitation.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploitation of this vulnerability can lead to system crashes, instability, or unauthorized access, allowing attackers to execute arbitrary code.
Yes, updating to the patched versions (6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14) will mitigate the vulnerability.
Regularly check security advisories for your packages and consider using tools like Vulert to receive real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
