Skip to content

Commit 6790afe

Browse files
CIQ Kernel Automationroxanan1996
authored andcommitted
exfat: fix double free in delayed_free
jira VULN-72068 cve CVE-2025-38206 commit-author Namjae Jeon <linkinjeon@kernel.org> commit 1f3d972 The double free could happen in the following path. exfat_create_upcase_table() exfat_create_upcase_table() : return error exfat_free_upcase_table() : free ->vol_utbl exfat_load_default_upcase_table : return error exfat_kill_sb() delayed_free() exfat_free_upcase_table() <--------- double free This patch set ->vol_util as NULL after freeing it. Reported-by: Jianzhou Zhao <xnxc22xnxc22@qq.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> (cherry picked from commit 1f3d972) Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
1 parent d6feec3 commit 6790afe

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

fs/exfat/nls.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -804,4 +804,5 @@ int exfat_create_upcase_table(struct super_block *sb)
804804
void exfat_free_upcase_table(struct exfat_sb_info *sbi)
805805
{
806806
kvfree(sbi->vol_utbl);
807+
sbi->vol_utbl = NULL;
807808
}

0 commit comments

Comments
 (0)