CVE-2025-38206

04.07.2025, 14:15

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix double free in delayed_free

The double free could happen in the following path.

exfat_create_upcase_table()
        exfat_create_upcase_table() : return error
        exfat_free_upcase_table() : free ->vol_utbl
        exfat_load_default_upcase_table : return error
     exfat_kill_sb()
           delayed_free()
                  exfat_free_upcase_table() <--------- double free
This patch set ->vol_util as NULL after freeing it.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Linux	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 4%

Vendor	Product	Version
linux	linux_kernel	5.7 ≤ 𝑥 < 5.10.239
linux	linux_kernel	5.11 ≤ 𝑥 < 5.15.186
linux	linux_kernel	5.16 ≤ 𝑥 < 6.15.4
debian	debian_linux	11.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bullseye	vulnerable
bullseye (security)	5.10.247-1 fixed
bookworm	vulnerable
bookworm (security)	vulnerable
trixie	vulnerable
trixie (security)	vulnerable
forky	6.17.13-1 fixed
sid	6.18.3-1 fixed

Common Weakness Enumeration

CWE-415 - Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References

https://git.kernel.org/stable/c/13d8de1b6568dcc31a95534ced16bc0c9a67bc15

https://git.kernel.org/stable/c/1f3d9724e16d62c7d42c67d6613b8512f2887c22

https://git.kernel.org/stable/c/66e84439ec2af776ce749e8540f8fdd257774152

https://git.kernel.org/stable/c/d3cef0e7a5c1aa6217c51faa9ce8ecac35d6e1fd

https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html