NetSight
IP …
high7.8

CVE-2025-38699

In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, t…

Impact

In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability. Set bfad->im to NULL if probing fails.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.33 before 5.4.297
from 5.5 before 5.10.241
from 5.11 before 5.15.190
from 5.16 before 6.1.149
from 6.2 before 6.6.103
from 6.7 before 6.12.43
DebianDebian Linux
Version 11.0

Weakness classification

CWE-415

References