CVE-2025-38699

In the Linux kernel, the following vulnerability has been resolved:

scsi: bfa: Double-free fix

When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL.

Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability.

Set bfad->im to NULL if probing fails.

A double-free bug in bfad_im_probe() could be triggered if probe fails: memory for bfad->im is released but the pointer is not cleared. During driver shutdown, bfad_im_probe_undo() frees it again, leading to a double free. Exploitation for privilege escalation is highly unlikely since this occurs only in the probe failure path and requires root privileges to load/unload the driver.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module bfa from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.