In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
Fix a kernel oops found while testing the stm32_pcie Endpoint driver with handling of PERST# deassertion:
During EP initialization, pci_epf_test_alloc_space() allocates all BARs, which are further freed if epc_set_bar() fails (for instance, due to no free inbound window).
However, when pci_epc_set_bar() fails, the error path:
pci_epc_set_bar() -> pci_epf_free_space()
does not clear the previous assignment to epf_test->reg[bar].
Then, if the host reboots, the PERST# deassertion restarts the BAR allocation sequence with the same allocation failure (no free inbound window), creating a double free situation since epf_test->reg[bar] was deallocated and is still non-NULL.
Thus, make sure that pci_epf_alloc_space() and pci_epf_free_space() invocations are symmetric, and as such, set epf_test->reg[bar] to NULL when memory is freed.
[kwilczynski: commit log]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxNo solution exists | Jun 20, 2025 | Jun 18, 2025 |
| Suse | — | Upgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azureUpgrade kernel-default-vdsoUpgrade kernel-default-livepatchUpgrade kernel-source-vanillaUpgrade kernel-64kbUpgrade kernel-docs-htmlUpgrade kernel-develUpgrade kernel-source-azureUpgrade kernel-azure-extraUpgrade kernel-64kb-extraUpgrade kernel-default-extraUpgrade kernel-symsUpgrade kernel-devel-azureUpgrade kernel-azure-vdsoUpgrade kernel-azure-develUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade kernel-64kb-develUpgrade kernel-zfcpdumpUpgrade kernel-docsUpgrade kernel-default | Dec 5, 2025 | Dec 5, 2025 |
| Ubuntu | — | Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-aws-64kUpgrade linux-image-aws-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-6.14.0-32-genericUpgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1013-awsUpgrade linux-image-oracle-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-gcpUpgrade linux-image-virtualUpgrade linux-image-realtimeUpgrade linux-image-oem-6.14Upgrade linux-image-aws-64k-6.14Upgrade linux-image-oracleUpgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-oem-24.04bUpgrade linux-image-realtime-6.14Upgrade linux-image-awsUpgrade linux-image-oem-24.04Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-generic-64kUpgrade linux-image-gcp-64kUpgrade linux-image-virtual-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-raspi-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-gcp-6.14Upgrade linux-image-azureUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-oem-24.04cUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-generic-6.14 | Jun 26, 2025 | Jun 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub