In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/283333079d96c84baa91f0c62b5e0cbec246b7a2 cve-icon cve-icon
https://git.kernel.org/stable/c/694d5b401036a614f8080085a9de6f86ff0742dc cve-icon cve-icon
https://git.kernel.org/stable/c/7e76fe9dfadbc00364d7523d5a109e9d3e4a7db2 cve-icon cve-icon
https://git.kernel.org/stable/c/827c8efa0d1afe817b90f3618afff552e88348d2 cve-icon cve-icon
https://git.kernel.org/stable/c/892f41e12c8689130d552a9eb2b77bafd26484ab cve-icon cve-icon
https://git.kernel.org/stable/c/8f45f089337d924db24397f55697cda0e6960516 cve-icon cve-icon
https://git.kernel.org/stable/c/bfe011297ddd2d0cd64752978baaa0c04cd20573 cve-icon cve-icon
https://git.kernel.org/stable/c/f992bc72f681c32a682d474a29c2135a64d4f4e5 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025102815-CVE-2025-40055-8290@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-40055 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-40055 cve-icon
History

Mon, 01 Dec 2025 06:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Wed, 29 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
References

Wed, 29 Oct 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Wed, 29 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Tue, 28 Oct 2025 12:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free.
Title ocfs2: fix double free in user_cluster_connect()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-10-28T11:48:29.665Z

Updated: 2025-12-01T06:17:03.000Z

Reserved: 2025-04-16T07:20:57.157Z

Link: CVE-2025-40055

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-28T12:15:39.780

Modified: 2025-10-30T15:05:32.197

Link: CVE-2025-40055

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-10-28T00:00:00Z

Links: CVE-2025-40055 - Bugzilla