Linux Kernel Vulnerability in PCI Endpoint Driver by Linux Foundation

CVE-2025-38069

What is CVE-2025-38069?

A double free vulnerability in the Linux kernel occurs when the PCI endpoint driver, specifically during the initialization of the stm32_pcie Endpoint driver, fails to deallocate memory correctly. When pci_epf_test_alloc_space() allocates memory for the Base Address Registers (BARs) and encounters an error during epc_set_bar(), it does not clear the reference to epf_test->reg[bar]. This oversight results in a potential double free situation upon a host reboot, leading to system instability. Ensuring that the allocations and deallocations are handled symmetrically by setting the reference to NULL upon memory free is crucial to mitigate this vulnerability.

References