Review reviewHigh

CVE-2025-38206

Linux Linux, linux kernel, debian linux

In the Linux kernel, the following vulnerability has been resolved: exfat: fix double free in delayed_free The double free could happen in the following path. exfat_create_upcase_table() exfat_create_upcase_table() : return error exfat_free_upcase_table() : free ->vol_utbl exfat_load_default_upcase_table : return error exfat_kill_sb() delayed_free() exfat_free_upcase_table() <--------- double free This patch set ->vol_util as NULL after freeing it.

CVSS: 7.8
EPSS: 0.16%
CISA KEV: Not listed
Published: 2025.07.04

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.16%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel, debian linux
Affected versions: >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 < 13d8de1b6568dcc31a95534ced16bc0c9a67bc15, >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 < 66e84439ec2af776ce749e8540f8fdd257774152, >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 < d3cef0e7a5c1aa6217c51faa9ce8ecac35d6e1fd, >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 < 1f3d9724e16d62c7d42c67d6613b8512f2887c22, >= 5.7, >= 5.7 < 5.10.239, >= 5.11 < 5.15.186, >= 5.16 < 6.15.4, 11.0
Fixed versions: 5.10.239, 5.15.186, 6.15.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel, debian linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-415