CVE-2025-38069 PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
A double free vulnerability in the Linux kernel PCI endpoint test driver allows a local attacker to cause a kernel oops and system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38069?
CVE-2025-38069 is a high-severity memory corruption vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
Fix a kernel oops found while testing the stm32_pcie Endpoint driver with handling of PERST# deassertion:
During EP initialization, pci_epf_test_alloc_space() allocates all BARs, which are further freed if epc_set_bar() fails (for instance, due to no free inbound window).
However, when pci_epc_set_bar() fails, the error path:
pci_epc_set_bar() -> pci_epf_free_space()
does not clear the previous assignment to epf_test->reg[bar].
Then, if the host reboots, the PERST# deassertion restarts the BAR allocation sequence with the same allocation failure (no free inbound window), creating a double free situation since epf_test->reg[bar] was deallocated and is still non-NULL.
Thus, make sure that pci_epf_alloc_space() and pci_epf_free_space() invocations are symmetric, and as such, set epf_test->reg[bar] to NULL when memory is freed.
[kwilczynski: commit log]
Weakness: CWE-415
Which versions are affected by CVE-2025-38069?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38069?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-38069 being exploited?
There is no known exploitation of CVE-2025-38069 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38069, DEBIAN-CVE-2025-38069, GHSA-4xrx-36pv-43r3, ROOT-OS-DEBIAN-11-CVE-2025-38069, ROOT-OS-DEBIAN-12-CVE-2025-38069, ROOT-OS-UBUNTU-2204-CVE-2025-38069 and 2 more.