Double-Free Vulnerability in Linux Kernel Affecting SCSI Drivers

CVE-2025-38699

What is CVE-2025-38699?

A flaw in the Linux kernel concerning SCSI drivers allows for a double-free vulnerability during device initialization and uninstallation. The issue arises in the bfad_im_probe() function, where failure to properly nullify the memory pointer leads to an attempt to free the same memory location twice. This can result in potential undefined behavior, application crashes, or exploitation by malicious actors. Proper modification necessitates setting the pointer to NULL after memory has been freed to mitigate risks during the driver lifecycle.

References