In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
Fix a kernel oops found while testing the stm32_pcie Endpoint driver with handling of PERST# deassertion:
During EP initialization, pci_epf_test_alloc_space() allocates all BARs, which are further freed if epc_set_bar() fails (for instance, due to no free inbound window).
However, when pci_epc_set_bar() fails, the error path:
pci_epc_set_bar() -> pci_epf_free_space()
does not clear the previous assignment to epf_test->reg[bar].
Then, if the host reboots, the PERST# deassertion restarts the BAR allocation sequence with the same allocation failure (no free inbound window), creating a double free situation since epf_test->reg[bar] was deallocated and is still non-NULL.
Thus, make sure that pci_epf_alloc_space() and pci_epf_free_space() invocations are symmetric, and as such, set epf_test->reg[bar] to NULL when memory is freed.
[kwilczynski: commit log]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution existsUpgrade linux | Jun 20, 2025 | Jun 18, 2025 |
| Suse | — | Upgrade kernel-sourceUpgrade kernel-64kbUpgrade kernel-default-livepatchUpgrade kernel-azureUpgrade kernel-azure-extraUpgrade kernel-default-vdsoUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade kernel-develUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade kernel-symsUpgrade kernel-macrosUpgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-docsUpgrade kernel-azure-vdsoUpgrade kernel-azure-develUpgrade kernel-kvmsmallUpgrade kernel-defaultUpgrade kernel-obs-qaUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-devel | Dec 5, 2025 | Dec 5, 2025 |
| Ubuntu | — | Upgrade linux-image-raspi-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1012-oemUpgrade linux-image-virtual-6.14Upgrade linux-image-azureUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-genericUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-oem-24.04cUpgrade linux-image-virtualUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-realtime-6.14Upgrade linux-image-oem-24.04bUpgrade linux-image-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-6.14Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1013-awsUpgrade linux-image-awsUpgrade linux-image-gcpUpgrade linux-image-oem-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-6.14.0-32-genericUpgrade linux-image-oem-24.04aUpgrade linux-image-aws-64kUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1014-raspi | Jun 26, 2025 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub