CVE-2025-38313
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38313
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38313.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38313
- Downstream
- Related
- Published
- 2025-07-10T07:42:21.314Z
- Modified
- 2025-11-28T02:34:52.708636Z
- Summary
- bus: fsl-mc: fix double-free on mc_dev
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bus: fsl-mc: fix double-free on mc_dev
The blamed commit tried to simplify how the deallocations are done but, in the process, introduced a double-free on the mc_dev variable.
In case the MC device is a DPRC, a new mcbus is allocated and the mcdev variable is just a reference to one of its fields. In this circumstance, on the error path only the mc_bus should be freed.
This commit introduces back the following checkpatch warning which is a false-positive.
WARNING: kfree(NULL) is safe and this check is probably not required + if (mcbus) + kfree(mcbus);
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38313.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/12e4431e5078847791936820bd39df9e1ee26d2e
- https://git.kernel.org/stable/c/1d5baab39e5b09a76870b345cdee7933871b881f
- https://git.kernel.org/stable/c/3135e03a92f6b5259d0a7f25f728e9e7866ede3f
- https://git.kernel.org/stable/c/4b23c46eb2d88924b93aca647bde9a4b9cf62cf9
- https://git.kernel.org/stable/c/7002b954c4a8b9965ba0f139812ee4a6f71beac8
- https://git.kernel.org/stable/c/873d47114fd5e5a1cad2018843671537cc71ac84
- https://git.kernel.org/stable/c/b2057374f326303c86d8423415ab58656eebc695
- https://git.kernel.org/stable/c/d694bf8a9acdbd061596f3e7549bc8cb70750a60
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38313.json
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-38313
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceda042fbed02904493ae6df26ec836045f5a7d3ce2Fixed12e4431e5078847791936820bd39df9e1ee26d2eFixed3135e03a92f6b5259d0a7f25f728e9e7866ede3fFixed7002b954c4a8b9965ba0f139812ee4a6f71beac8Fixedb2057374f326303c86d8423415ab58656eebc695Fixed4b23c46eb2d88924b93aca647bde9a4b9cf62cf9Fixed1d5baab39e5b09a76870b345cdee7933871b881fFixed873d47114fd5e5a1cad2018843671537cc71ac84Fixedd694bf8a9acdbd061596f3e7549bc8cb70750a60
Linux / Kernel
Package
- Name
- Kernel
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced4.13.0Fixed5.4.295
- Type
- ECOSYSTEM
- Events
-
Introduced5.5.0Fixed5.10.239
- Type
- ECOSYSTEM
- Events
-
Introduced5.11.0Fixed5.15.186
- Type
- ECOSYSTEM
- Events
-
Introduced5.16.0Fixed6.1.142
- Type
- ECOSYSTEM
- Events
-
Introduced6.2.0Fixed6.6.94
- Type
- ECOSYSTEM
- Events
-
Introduced6.7.0Fixed6.12.34
- Type
- ECOSYSTEM
- Events
-
Introduced6.13.0Fixed6.15.3