CVE-2025-38069

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops

Fix a kernel oops found while testing the stm32_pcie Endpoint driver

with handling of PERST# deassertion:

During EP initialization, pci_epf_test_alloc_space() allocates all BARs,

which are further freed if epc_set_bar() fails (for instance, due to no

free inbound window).

However, when pci_epc_set_bar() fails, the error path:

pci_epc_set_bar() ->

pci_epf_free_space()

does not clear the previous assignment to epf_test->reg[bar].

Then, if the host reboots, the PERST# deassertion restarts the BAR

allocation sequence with the same allocation failure (no free inbound

window), creating a double free situation since epf_test->reg[bar] was

deallocated and is still non-NULL.

Thus, make sure that pci_epf_alloc_space() and pci_epf_free_space()

invocations are symmetric, and as such, set epf_test->reg[bar] to NULL

when memory is freed.

[kwilczyn

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References