CVE-2025-37817

Summary

In the Linux kernel, the following vulnerability has been resolved:

mcb: fix a double free bug in chameleon_parse_gdd()

In chameleon_parse_gdd(), if mcb_device_register() fails, 'mdev' would be released in mcb_device_register() via put_device(). Thus, goto 'err' label and free 'mdev' again causes a double free. Just return if mcb_device_register() fails.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux3764e82e5150d87b205c10cd78a9c9ab86fbfa51 < d70184958b0ea8c0fd52e2b456654b503e769fc8affected
LinuxLinux3764e82e5150d87b205c10cd78a9c9ab86fbfa51 < 4ffe8c9fb561e4427dd1a3056cd5b3685b74f78daffected
LinuxLinux3764e82e5150d87b205c10cd78a9c9ab86fbfa51 < 59f993cd36b6e28a394ba3d977e8ffe5c9884e3baffected
LinuxLinux3764e82e5150d87b205c10cd78a9c9ab86fbfa51 < c5b8a549ef1fcc6066b037a3962c79d60465ba0baffected
LinuxLinux3764e82e5150d87b205c10cd78a9c9ab86fbfa51 < 96838eb1836fd372e42be5db84f0b333b65146a6affected
LinuxLinux3764e82e5150d87b205c10cd78a9c9ab86fbfa51 < df1a5d5c6134224f9298e5189230f9d29ae50cacaffected
LinuxLinux3764e82e5150d87b205c10cd78a9c9ab86fbfa51 < bcc7d58ee5173e34306026bd01e1fbf75e169d37affected
LinuxLinux3764e82e5150d87b205c10cd78a9c9ab86fbfa51 < 7c7f1bfdb2249f854a736d9b79778c7e5a29a150affected
LinuxLinux3.15affected
LinuxLinux0 < 3.15unaffected
LinuxLinux5.4.293 <= 5.4.*unaffected
LinuxLinux5.10.237 <= 5.10.*unaffected
LinuxLinux5.15.181 <= 5.15.*unaffected
LinuxLinux6.1.136 <= 6.1.*unaffected
LinuxLinux6.6.89 <= 6.6.*unaffected
LinuxLinux6.12.26 <= 6.12.*unaffected
LinuxLinux6.14.5 <= 6.14.*unaffected
LinuxLinux6.15 <= *unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

References