CVE-2025-38313bus: fsl-mc: fix double-free on mc_dev
- 7.8HighCVSS base score
- 0.19%Exploitation in 30 daysEPSS · top 91% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix double-free on mc_dev The blamed commit tried to simplify how the deallocations are done but, in the process, introduced a double-free on the mc_dev variable. In case the MC device is a DPRC, a new mc_bus is allocated and the mc_dev variable is just a reference to one of its fields. In this circumstance, on the error path only the mc_bus should be freed. This commit introduces back the following checkpatch warning which is a false-positive. WARNING: kfree(NULL) is safe and this check is probably not required + if (mc_bus) + kfree(mc_bus);
Timeline
ID reserved
By Linux
- 3 months later
· 3 months later
Published
- 10 months later
· 10 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.19% · top 91% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected a042fbed02904493ae6df26ec836045f5a7d3ce2 – < 12e4431e5078847791936820bd39df9e1ee26d2e
- affected a042fbed02904493ae6df26ec836045f5a7d3ce2 – < 3135e03a92f6b5259d0a7f25f728e9e7866ede3f
- affected a042fbed02904493ae6df26ec836045f5a7d3ce2 – < 7002b954c4a8b9965ba0f139812ee4a6f71beac8
- affected a042fbed02904493ae6df26ec836045f5a7d3ce2 – < b2057374f326303c86d8423415ab58656eebc695
- affected a042fbed02904493ae6df26ec836045f5a7d3ce2 – < 4b23c46eb2d88924b93aca647bde9a4b9cf62cf9
- affected a042fbed02904493ae6df26ec836045f5a7d3ce2 – < 1d5baab39e5b09a76870b345cdee7933871b881f
- affected a042fbed02904493ae6df26ec836045f5a7d3ce2 – < 873d47114fd5e5a1cad2018843671537cc71ac84
- affected a042fbed02904493ae6df26ec836045f5a7d3ce2 – < d694bf8a9acdbd061596f3e7549bc8cb70750a60
- affected 4.13
- unaffected < 4.13
- unaffected 5.4.295 – ≤ 5.4.*
- unaffected 5.10.239 – ≤ 5.10.*
- unaffected 5.15.186 – ≤ 5.15.*
- unaffected 6.1.142 – ≤ 6.1.*
- unaffected 6.6.94 – ≤ 6.6.*
- unaffected 6.12.34 – ≤ 6.12.*
- unaffected 6.15.3 – ≤ 6.15.*
- unaffected 6.16 – ≤ *
References
References10
- https://git.kernel.org/stable/c/12e4431e5078847791936820bd39df9e1ee26d2e (opens in a new tab)
- https://git.kernel.org/stable/c/3135e03a92f6b5259d0a7f25f728e9e7866ede3f (opens in a new tab)
- https://git.kernel.org/stable/c/7002b954c4a8b9965ba0f139812ee4a6f71beac8 (opens in a new tab)
- https://git.kernel.org/stable/c/b2057374f326303c86d8423415ab58656eebc695 (opens in a new tab)
- https://git.kernel.org/stable/c/4b23c46eb2d88924b93aca647bde9a4b9cf62cf9 (opens in a new tab)
- https://git.kernel.org/stable/c/1d5baab39e5b09a76870b345cdee7933871b881f (opens in a new tab)
- https://git.kernel.org/stable/c/873d47114fd5e5a1cad2018843671537cc71ac84 (opens in a new tab)
- https://git.kernel.org/stable/c/d694bf8a9acdbd061596f3e7549bc8cb70750a60 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-20935 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-38313)Record last updated .