---
id: CVE-2025-38069
title: 'PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops

  Fix a kernel oops found while testing the stm32_pcie Endpoint driver
  with handling of PERST# de…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 <
    e2e43854ab72a9d4908ac2bf6087f80aa138a8b5
  - >-
    Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 <
    761db4ca3a469f2070757acd4e104dff5125ca99
  - >-
    Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 <
    fe2329eff5bee461ebcafadb6ca1df0cbf5945fd
  - >-
    Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 <
    8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee
  - >-
    Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 <
    934e9d137d937706004c325fa1474f9e3f1ba10a
  - Linux 4.12
published: '2025-06-18'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:21:39.173Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38069'
references:
  - url: 'https://git.kernel.org/stable/c/e2e43854ab72a9d4908ac2bf6087f80aa138a8b5'
  - url: 'https://git.kernel.org/stable/c/761db4ca3a469f2070757acd4e104dff5125ca99'
  - url: 'https://git.kernel.org/stable/c/fe2329eff5bee461ebcafadb6ca1df0cbf5945fd'
  - url: 'https://git.kernel.org/stable/c/8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee'
  - url: 'https://git.kernel.org/stable/c/934e9d137d937706004c325fa1474f9e3f1ba10a'
tags:
  - cve.org
epss: 0.00231
epssPercentile: 0.13945
ingestedAt: '2026-10-21T12:48:53.707Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops

Fix a kernel oops found while testing the stm32_pcie Endpoint driver
with handling of PERST# deassertion:

During EP initialization, pci_epf_test_alloc_space() allocates all BARs,
which are further freed if epc_set_bar() fails (for instance, due to no
free inbound window).

However, when pci_epc_set_bar() fails, the error path:

  pci_epc_set_bar() ->
    pci_epf_free_space()

does not clear the previous assignment to epf_test->reg[bar].

Then, if the host reboots, the PERST# deassertion restarts the BAR
allocation sequence with the same allocation failure (no free inbound
window), creating a double free situation since epf_test->reg[bar] was
deallocated and is still non-NULL.

Thus, make sure that pci_epf_alloc_space() and pci_epf_free_space()
invocations are symmetric, and as such, set epf_test->reg[bar] to NULL
when memory is freed.

[kwilczynski: commit log]

## Affected

- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < e2e43854ab72a9d4908ac2bf6087f80aa138a8b5`
- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < 761db4ca3a469f2070757acd4e104dff5125ca99`
- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < fe2329eff5bee461ebcafadb6ca1df0cbf5945fd`
- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < 8b83893d1f6c6061a7d58169ecdf9d5ee9f306ee`
- `Linux >= 349e7a85b25fa6ee82902d9be2cc5f3bec815120 < 934e9d137d937706004c325fa1474f9e3f1ba10a`
- `Linux 4.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.