CVE-2025-38206

exfat: fix double free in delayed_free

State: Published
Severity: 7.8 High
Published: Jul 4, 2025
Updated: Sep 2, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix double free in delayed_free

The double free could happen in the following path.

exfat_create_upcase_table() exfat_create_upcase_table() : return error exfat_free_upcase_table() : free ->vol_utbl exfat_load_default_upcase_table : return error exfat_kill_sb() delayed_free() exfat_free_upcase_table() <--------- double free This patch set ->vol_util as NULL after freeing it.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 13d8de1b6568dcc31a95534ced16bc0c9a67bc15Affected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 66e84439ec2af776ce749e8540f8fdd257774152Affected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before ea27703eb0efbadcd45b9949526160ed90536a72Affected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before ac65f76db9b2ff3fbc9e198c0e9aaf81b111b7d0Affected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 29abaf93357f4a7d083cf399d4306999e20db31dAffected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before d3cef0e7a5c1aa6217c51faa9ce8ecac35d6e1fdAffected 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 1f3d9724e16d62c7d42c67d6613b8512f2887c22Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.239 through 5.10.Not affected 5.15.186 through 5.15.Not affected 6.1.187 through 6.1.Not affected 6.6.156 through 6.6.Not affected 6.12.108 through 6.12.Not affected 6.15.4 through 6.15.Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 13d8de1b6568dcc31a95534ced16bc0c9a67bc15Affected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 66e84439ec2af776ce749e8540f8fdd257774152Affected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before ea27703eb0efbadcd45b9949526160ed90536a72Affected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before ac65f76db9b2ff3fbc9e198c0e9aaf81b111b7d0Affected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 29abaf93357f4a7d083cf399d4306999e20db31dAffected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before d3cef0e7a5c1aa6217c51faa9ce8ecac35d6e1fdAffected
1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 to before 1f3d9724e16d62c7d42c67d6613b8512f2887c22Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.239 through 5.10.*Not affected
5.15.186 through 5.15.*Not affected
6.1.187 through 6.1.*Not affected
6.6.156 through 6.6.*Not affected
6.12.108 through 6.12.*Not affected
6.15.4 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.