VYPR
← All advisories
High severity7.8NVD Advisory· Published Sep 4, 2025· Updated May 12, 2026

CVE-2025-38699

CVE-2025-38699

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: bfa: Double-free fix

When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL.

Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability.

Set bfad->im to NULL if probing fails.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

92

Patches

Vulnerability mechanics

References

12

News mentions

1