CVE-2025-38206: exfat: fix double free in delayed_free
In the Linux kernel, the following vulnerability has been resolved:
exfat: fix double free in delayedfree
The double free could happen in the following path.
exfatcreateupcasetable() exfatcreateupcasetable() : return error exfatfreeupcasetable() : free ->volutbl exfatloaddefaultupcasetable : return error exfatkillsb() delayedfree() exfatfreeupcasetable() <--------- double free This patch set ->volutil as NULL after freeing it.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
exfat: fix double free in delayedfree
The double free could happen in the following path.
exfatcreateupcasetable() exfatcreateupcasetable() : return error exfatfreeupcasetable() : free -volutbl exfatloaddefaultupcasetable : return error exfatkillsb() delayedfree() exfatfreeupcasetable() --------- double free This patch set -volutil as NULL after freeing it.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38206?
CVE-2025-38206 has been classified with a medium severity level due to the potential for a double free vulnerability in the Linux kernel.
How do I fix CVE-2025-38206?
To fix CVE-2025-38206, you should update the Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-38206?
CVE-2025-38206 affects systems running vulnerable versions of the Linux kernel that implement exFAT functionality.
What is the risk of not addressing CVE-2025-38206?
Not addressing CVE-2025-38206 could lead to system instability or potential exploitation through double free vulnerabilities.
When was CVE-2025-38206 discovered?
CVE-2025-38206 was disclosed as a vulnerability affecting the Linux kernel and its exFAT implementation.