CVE-2025-38313

bus: fsl-mc: fix double-free on mc_dev

State: Published
Severity: Not scored
Published: Jul 10, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

bus: fsl-mc: fix double-free on mc_dev

The blamed commit tried to simplify how the deallocations are done but, in the process, introduced a double-free on the mc_dev variable.

In case the MC device is a DPRC, a new mc_bus is allocated and the mc_dev variable is just a reference to one of its fields. In this circumstance, on the error path only the mc_bus should be freed.

This commit introduces back the following checkpatch warning which is a false-positive.

WARNING: kfree(NULL) is safe and this check is probably not required + if (mc_bus) + kfree(mc_bus);

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 12e4431e5078847791936820bd39df9e1ee26d2eAffected a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 3135e03a92f6b5259d0a7f25f728e9e7866ede3fAffected a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 7002b954c4a8b9965ba0f139812ee4a6f71beac8Affected a042fbed02904493ae6df26ec836045f5a7d3ce2 to before b2057374f326303c86d8423415ab58656eebc695Affected a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 4b23c46eb2d88924b93aca647bde9a4b9cf62cf9Affected a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 1d5baab39e5b09a76870b345cdee7933871b881fAffected a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 873d47114fd5e5a1cad2018843671537cc71ac84Affected a042fbed02904493ae6df26ec836045f5a7d3ce2 to before d694bf8a9acdbd061596f3e7549bc8cb70750a60Affected
LinuxLinux	4.13Affected before 4.13Not affected 5.4.295 through 5.4.Not affected 5.10.239 through 5.10.Not affected 5.15.186 through 5.15.Not affected 6.1.142 through 6.1.Not affected 6.6.94 through 6.6.Not affected 6.12.34 through 6.12.Not affected 6.15.3 through 6.15.*Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 12e4431e5078847791936820bd39df9e1ee26d2eAffected
a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 3135e03a92f6b5259d0a7f25f728e9e7866ede3fAffected
a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 7002b954c4a8b9965ba0f139812ee4a6f71beac8Affected
a042fbed02904493ae6df26ec836045f5a7d3ce2 to before b2057374f326303c86d8423415ab58656eebc695Affected
a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 4b23c46eb2d88924b93aca647bde9a4b9cf62cf9Affected
a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 1d5baab39e5b09a76870b345cdee7933871b881fAffected
a042fbed02904493ae6df26ec836045f5a7d3ce2 to before 873d47114fd5e5a1cad2018843671537cc71ac84Affected
a042fbed02904493ae6df26ec836045f5a7d3ce2 to before d694bf8a9acdbd061596f3e7549bc8cb70750a60Affected

LinuxLinux

4.13Affected
before 4.13Not affected
5.4.295 through 5.4.*Not affected
5.10.239 through 5.10.*Not affected
5.15.186 through 5.15.*Not affected
6.1.142 through 6.1.*Not affected
6.6.94 through 6.6.*Not affected
6.12.34 through 6.12.*Not affected
6.15.3 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.