CVE-2025-37817

mcb: fix a double free bug in chameleon_parse_gdd()

State: Published
Severity: Not scored
Published: May 8, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

mcb: fix a double free bug in chameleon_parse_gdd()

In chameleon_parse_gdd(), if mcb_device_register() fails, 'mdev' would be released in mcb_device_register() via put_device(). Thus, goto 'err' label and free 'mdev' again causes a double free. Just return if mcb_device_register() fails.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before d70184958b0ea8c0fd52e2b456654b503e769fc8Affected 3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before 4ffe8c9fb561e4427dd1a3056cd5b3685b74f78dAffected 3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before 59f993cd36b6e28a394ba3d977e8ffe5c9884e3bAffected 3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before c5b8a549ef1fcc6066b037a3962c79d60465ba0bAffected 3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before 96838eb1836fd372e42be5db84f0b333b65146a6Affected 3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before df1a5d5c6134224f9298e5189230f9d29ae50cacAffected 3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before bcc7d58ee5173e34306026bd01e1fbf75e169d37Affected 3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before 7c7f1bfdb2249f854a736d9b79778c7e5a29a150Affected
LinuxLinux	3.15Affected before 3.15Not affected 5.4.293 through 5.4.Not affected 5.10.237 through 5.10.Not affected 5.15.181 through 5.15.Not affected 6.1.136 through 6.1.Not affected 6.6.89 through 6.6.Not affected 6.12.26 through 6.12.Not affected 6.14.5 through 6.14.*Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before d70184958b0ea8c0fd52e2b456654b503e769fc8Affected
3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before 4ffe8c9fb561e4427dd1a3056cd5b3685b74f78dAffected
3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before 59f993cd36b6e28a394ba3d977e8ffe5c9884e3bAffected
3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before c5b8a549ef1fcc6066b037a3962c79d60465ba0bAffected
3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before 96838eb1836fd372e42be5db84f0b333b65146a6Affected
3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before df1a5d5c6134224f9298e5189230f9d29ae50cacAffected
3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before bcc7d58ee5173e34306026bd01e1fbf75e169d37Affected
3764e82e5150d87b205c10cd78a9c9ab86fbfa51 to before 7c7f1bfdb2249f854a736d9b79778c7e5a29a150Affected

LinuxLinux

3.15Affected
before 3.15Not affected
5.4.293 through 5.4.*Not affected
5.10.237 through 5.10.*Not affected
5.15.181 through 5.15.*Not affected
6.1.136 through 6.1.*Not affected
6.6.89 through 6.6.*Not affected
6.12.26 through 6.12.*Not affected
6.14.5 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.