CVE-2025-40253

Double-free corruption occurs in the s390 CTC MPC driver when mpc_rcvd_sweep_req() frees the mpcginfo structure, followed by ctcmpc_unpack_skb() freeing the same pointer. Clang's static analyzer flagged this ownership confusion. The duplicate kfree() corrupts slab metadata, potentially crashing the kernel or enabling exploitation.

Exclusively impacts s390 mainframes using Channel-to-Channel MPC networking. The CTC subsystem sees limited deployment outside legacy IBM environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.