CVE-2025-40055

ocfs2: fix double free in user_cluster_connect()

State: Published
Severity: Not scored
Published: Oct 28, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix double free in user_cluster_connect()

user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 283333079d96c84baa91f0c62b5e0cbec246b7a2Affected c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before f992bc72f681c32a682d474a29c2135a64d4f4e5Affected c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 827c8efa0d1afe817b90f3618afff552e88348d2Affected c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before bfe011297ddd2d0cd64752978baaa0c04cd20573Affected c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 7e76fe9dfadbc00364d7523d5a109e9d3e4a7db2Affected c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 694d5b401036a614f8080085a9de6f86ff0742dcAffected c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 892f41e12c8689130d552a9eb2b77bafd26484abAffected c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 8f45f089337d924db24397f55697cda0e6960516Affected
LinuxLinux	3.14Affected before 3.14Not affected 5.4.301 through 5.4.Not affected 5.10.246 through 5.10.Not affected 5.15.195 through 5.15.Not affected 6.1.156 through 6.1.Not affected 6.6.112 through 6.6.Not affected 6.12.53 through 6.12.Not affected 6.17.3 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 283333079d96c84baa91f0c62b5e0cbec246b7a2Affected
c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before f992bc72f681c32a682d474a29c2135a64d4f4e5Affected
c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 827c8efa0d1afe817b90f3618afff552e88348d2Affected
c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before bfe011297ddd2d0cd64752978baaa0c04cd20573Affected
c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 7e76fe9dfadbc00364d7523d5a109e9d3e4a7db2Affected
c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 694d5b401036a614f8080085a9de6f86ff0742dcAffected
c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 892f41e12c8689130d552a9eb2b77bafd26484abAffected
c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 to before 8f45f089337d924db24397f55697cda0e6960516Affected

LinuxLinux

3.14Affected
before 3.14Not affected
5.4.301 through 5.4.*Not affected
5.10.246 through 5.10.*Not affected
5.15.195 through 5.15.*Not affected
6.1.156 through 6.1.*Not affected
6.6.112 through 6.6.*Not affected
6.12.53 through 6.12.*Not affected
6.17.3 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.