In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
Fix a kernel oops found while testing the stm32_pcie Endpoint driver with handling of PERST# deassertion:
During EP initialization, pci_epf_test_alloc_space() allocates all BARs, which are further freed if epc_set_bar() fails (for instance, due to no free inbound window).
However, when pci_epc_set_bar() fails, the error path:
pci_epc_set_bar() -> pci_epf_free_space()
does not clear the previous assignment to epf_test->reg[bar].
Then, if the host reboots, the PERST# deassertion restarts the BAR allocation sequence with the same allocation failure (no free inbound window), creating a double free situation since epf_test->reg[bar] was deallocated and is still non-NULL.
Thus, make sure that pci_epf_alloc_space() and pci_epf_free_space() invocations are symmetric, and as such, set epf_test->reg[bar] to NULL when memory is freed.
[kwilczynski: commit log]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jun 20, 2025 | Jun 18, 2025 |
| Suse | — | Upgrade kernel-kvmsmallUpgrade kernel-obs-qaUpgrade kernel-azure-develUpgrade kernel-azure-vdsoUpgrade kernel-symsUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade kernel-64kb-develUpgrade kernel-docsUpgrade kernel-defaultUpgrade kernel-default-extraUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade kernel-source-vanillaUpgrade kernel-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-source-azureUpgrade kernel-default-vdsoUpgrade kernel-docs-htmlUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-default-livepatchUpgrade kernel-azure-extraUpgrade kernel-64kb-extra | Dec 5, 2025 | Dec 5, 2025 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-oracleUpgrade linux-image-realtime-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-6.14Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-6.14.0-1013-awsUpgrade linux-image-6.14.0-32-genericUpgrade linux-image-realtimeUpgrade linux-image-awsUpgrade linux-image-6.8.0-1035-nvidia-tegra-rtUpgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-oem-24.04bUpgrade linux-image-aws-64k-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-oem-6.14Upgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-aws-64kUpgrade linux-image-aws-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-generic-6.14Upgrade linux-image-virtual-6.14Upgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-genericUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-raspiUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-azureUpgrade linux-image-gcp-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1035-nvidia-tegraUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-nvidia-tegraUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-raspi-6.14 | Jun 26, 2025 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub