{"cve":"CVE-2025-38313","nvd":{"published":"2025-07-10T08:15:30.240","modified":"2026-06-17T09:16:36.130","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbus: fsl-mc: fix double-free on mc_dev\n\nThe blamed commit tried to simplify how the deallocations are done but,\nin the process, introduced a double-free on the mc_dev variable.\n\nIn case the MC device is a DPRC, a new mc_bus is allocated and the\nmc_dev variable is just a reference to one of its fields. In this\ncircumstance, on the error path only the mc_bus should be freed.\n\nThis commit introduces back the following checkpatch warning which is a\nfalse-positive.\n\nWARNING: kfree(NULL) is safe and this check is probably not required\n+       if (mc_bus)\n+               kfree(mc_bus);","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-415"],"references":["https://git.kernel.org/stable/c/12e4431e5078847791936820bd39df9e1ee26d2e","https://git.kernel.org/stable/c/1d5baab39e5b09a76870b345cdee7933871b881f","https://git.kernel.org/stable/c/3135e03a92f6b5259d0a7f25f728e9e7866ede3f","https://git.kernel.org/stable/c/4b23c46eb2d88924b93aca647bde9a4b9cf62cf9","https://git.kernel.org/stable/c/7002b954c4a8b9965ba0f139812ee4a6f71beac8"],"products":["debian:debian_linux","linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:04:28.436527499+00:00"},"epss":{"cve":"CVE-2025-38313","score":0.00191,"percentile":0.08754,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}