In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability. Set bfad->im to NULL if probing fails.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2025090452-CVE-2025-38699-9ca5@gregkh/T
For production environments using the bfa driver, is there any recommended interim measure while waiting for the official update? https://grannygame.org/ https://lore.kernel.org/linux-cve-announce/2025090452-CVE-2025-38699-9ca5@gregkh/T