{"id":"CVE-2025-38069","title":"PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops\n\nFix a kernel oops found while testing the stm32_pcie Endpoint driver\nwith handling of PERST# de…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < e2e43854ab72a9d4908ac2bf6087f80aa138a8b5","Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < 761db4ca3a469f2070757acd4e104dff5125ca99","Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < fe2329eff5bee461ebcafadb6ca1df0cbf5945fd","Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < 8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee","Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < 934e9d137d937706004c325fa1474f9e3f1ba10a","Linux 4.12"],"published":"2025-06-18","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:21:39.173Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38069","references":[{"url":"https://git.kernel.org/stable/c/e2e43854ab72a9d4908ac2bf6087f80aa138a8b5"},{"url":"https://git.kernel.org/stable/c/761db4ca3a469f2070757acd4e104dff5125ca99"},{"url":"https://git.kernel.org/stable/c/fe2329eff5bee461ebcafadb6ca1df0cbf5945fd"},{"url":"https://git.kernel.org/stable/c/8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee"},{"url":"https://git.kernel.org/stable/c/934e9d137d937706004c325fa1474f9e3f1ba10a"}],"tags":["cve.org"],"epss":0.00231,"epssPercentile":0.13945,"ingestedAt":"2026-10-21T12:48:53.707Z","slug":"CVE-2025-38069","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops\n\nFix a kernel oops found while testing the stm32_pcie Endpoint driver\nwith handling of PERST# deassertion:\n\nDuring EP initialization, pci_epf_test_alloc_space() allocates all BARs,\nwhich are further freed if epc_set_bar() fails (for instance, due to no\nfree inbound window).\n\nHowever, when pci_epc_set_bar() fails, the error path:\n\n  pci_epc_set_bar() ->\n    pci_epf_free_space()\n\ndoes not clear the previous assignment to epf_test->reg[bar].\n\nThen, if the host reboots, the PERST# deassertion restarts the BAR\nallocation sequence with the same allocation failure (no free inbound\nwindow), creating a double free situation since epf_test->reg[bar] was\ndeallocated and is still non-NULL.\n\nThus, make sure that pci_epf_alloc_space() and pci_epf_free_space()\ninvocations are symmetric, and as such, set epf_test->reg[bar] to NULL\nwhen memory is freed.\n\n[kwilczynski: commit log]\n\n## Affected\n\n- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < e2e43854ab72a9d4908ac2bf6087f80aa138a8b5`\n- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < 761db4ca3a469f2070757acd4e104dff5125ca99`\n- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < fe2329eff5bee461ebcafadb6ca1df0cbf5945fd`\n- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < 8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee`\n- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < 934e9d137d937706004c325fa1474f9e3f1ba10a`\n- `Linux 4.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}