CVE-2025-38699

What it actually does

Double-free in bfad_im_probe failure path leaves bfad->im dangling; subsequent bfad_im_probe_undo during driver unload frees the pointer a second time, enabling kernel memory corruption.

Why it matters to the business

Local users on systems using the bfa SCSI driver can trigger kernel crashes or memory corruption during driver unload after a failed probe, potentially leading to denial of service or local privilege escalation on unpatched kernels.

How an attack unfolds

An attacker with local access forces bfad_im_probe to fail during initialization, then triggers driver removal so the state machine calls bfad_im_probe_undo which frees the already-freed pointer, resulting in memory corruption that may be leveraged for code execution.

How to fix it

Update the Linux kernel to the commit 684c92bb08a25ed3c0356bc7eb532ed5b19588dd or later stable releases that contain the fix; ensure bfad->im is set to NULL after any free in the probe error path.

How to confirm the fix worked

Verify the running kernel contains commit 684c92bb08a25ed3c0356bc7eb532ed5b19588dd; confirm bfad_im_probe failure paths now explicitly null the pointer before returning.

Typical attack path

1. Obtain local user access on a system loading the bfa driver
2. Cause bfad_im_probe to fail during adapter initialization
3. Trigger driver unload or module removal to enter bfad_sm_stopping state
4. Observe second free of bfad->im pointer and exploit resulting corruption

How to detect it

Review kernel logs and dmesg for double-free warnings or slab corruption messages involving bfad structures; examine crash dumps for repeated frees of the same im pointer during module unload.

What your security team should do

• Apply the referenced kernel commit or newer stable branch immediately on all systems using the bfa driver
• Audit boot logs and driver initialization failures for bfa probe errors on production hosts
• Restrict local access and module loading privileges until patches are deployed
• Monitor for kernel oops or panic reports referencing bfa or bfad_im_probe_undo