Cloudanix VulnDB

CVE-2025-38069

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Jun 18, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux kernel handling of certain hardware connections can cause the whole system to crash unexpectedly.

Exploitation
Other
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Double free of PCI endpoint BAR memory in pci-epf-test due to pci_epf_free_space not clearing epf_test->reg[bar] pointer on pci_epc_set_bar failure, causing kernel oops on subsequent PERST# deassertion and re-initialization.

Why it matters to the business

Kernel crashes disrupt systems using affected PCI endpoint drivers, leading to downtime in embedded, virtualization, or hardware testing environments until patched.

How an attack unfolds

An attacker triggers repeated BAR allocation failures (e.g., no free inbound window) during EP initialization; on host reboot and PERST# deassertion the error path re-enters without clearing the freed pointer, resulting in double free and oops. No known threat actors or ransomware use.

How to fix it

Apply the fix in Linux kernel commit fe2329eff5bee461ebcafadb6ca1df0cbf5945fd ensuring symmetric alloc/free and NULLing epf_test->reg[bar] after pci_epf_free_space. For lxc on Mageia 5 update to 1.0.8-1.mga5.

How to confirm the fix worked

Confirm source contains the NULL assignment after free in the error path; reproduce with stm32_pcie endpoint driver under allocation-failure conditions and verify no oops occurs.

Typical attack path

  1. Cause pci_epc_set_bar failure during pci_epf_test_alloc_space
  2. Allow host reboot or PERST# deassertion
  3. Re-trigger identical allocation failure to hit non-NULL freed pointer
  4. Induce kernel oops via double free

How to detect it

Search kernel logs and dmesg for oops/panic entries mentioning pci_epf_test, pci_epf_alloc_space, pci_epf_free_space, or double-free conditions during endpoint BAR setup or PERST events.

  • pci_epf_test_alloc_space
  • pci_epf_free_space
  • epf_test->reg[bar]
  • PERST# deassertion

What your security team should do

  • Upgrade affected kernels to the fixed commit immediately
  • Monitor kernel logs for oops related to pci_epf_test and PERST
  • Limit exposure of untrusted PCI endpoint configurations until updated

The record

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops Fix a kernel oops found while testing the stm32_pcie Endpoint driver with handling of PERST# deassertion: During EP initialization, pci_epf_test_alloc_space() allocates all BARs, which are further freed if epc_set_bar() fails (for instance, due to no free inbound window). However, when pci_epc_set_bar() fails, the error path: pci_epc_set_bar() -> pci_epf_free_space() does not clear the previous assignment to epf_test->reg[bar]. Then, if the host reboots, the PERST# deassertion restarts the BAR allocation sequence with the same allocation failure (no free inbound window), creating a double free situation since epf_test->reg[bar] was deallocated and is still non-NULL. Thus, make sure that pci_epf_alloc_space() and pci_epf_free_space() invocations are symmetric, and as such, set epf_test->reg[bar] to NULL when memory is freed. [kwilczynski: commit log]

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 6.12.32-1
Linux Kernel 0 6.12.31
Linux Kernel 4.12.0 6.12.31

Related vulnerabilities