AZL-73644
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-73644.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-73644
- Upstream
- Published
- 2025-09-04T16:15:38Z
- Modified
- 2026-04-01T05:22:19.549839Z
- Summary
- CVE-2025-38699 affecting package kernel for versions less than 5.15.200.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
scsi: bfa: Double-free fix
When the bfadimprobe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL.
Subsequently, during driver uninstallation, when the state machine enters the bfadsmstopping state and calls the bfadimprobe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability.
Set bfad->im to NULL if probing fails.
- References