CVE-2025-38699

Q: What is the severity of CVE-2025-38699?

CVE-2025-38699 has a CVSS score of 7.8 (HIGH). A double-free vulnerability in the Linux kernel's bfa SCSI driver allows attackers to potentially crash the kernel or execute arbitrary code with kernel privileges. This affects systems using the bfa driver for Brocade Fibre Channel adapters. Attackers need local access to exploit this vulnerability.

7.8 HIGH

📋 TL;DR

A double-free vulnerability in the Linux kernel's bfa SCSI driver allows attackers to potentially crash the kernel or execute arbitrary code with kernel privileges. This affects systems using the bfa driver for Brocade Fibre Channel adapters. Attackers need local access to exploit this vulnerability.

💻 Affected Systems

Products:

Linux kernel with bfa SCSI driver enabled

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if bfa driver is loaded (typically when Brocade Fibre Channel adapters are present). Most systems don't have this driver loaded by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel-level code execution allowing complete system compromise.

🟠

Likely Case

Kernel panic causing system crash and denial of service, requiring physical or remote console access to reboot.

🟢

If Mitigated

System crash requiring reboot, but no data loss if filesystems are journaled and applications have proper recovery mechanisms.

🌐 Internet-Facing: LOW - Requires local access to the system, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local attackers or malicious users could exploit this to crash systems or potentially escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger driver initialization failure followed by unload. Exploit would need to control timing and memory state.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 13f613228cf3c96a038424cd97aa4d6aadc66294, 39cfe2c83146aad956318f866d0ee471b7a61fa5, 50d9bd48321038bd6e15af5a454bbcd180cf6f80, 684c92bb08a25ed3c0356bc7eb532ed5b19588dd, or 8456f862cb95bcc3a831e1ba87c0c17068be0f3f

Vendor Advisory: https://git.kernel.org/stable/c/13f613228cf3c96a038424cd97aa4d6aadc66294

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable bfa driver

linux

Prevent loading of vulnerable bfa SCSI driver

echo 'blacklist bfa' >> /etc/modprobe.d/blacklist.conf
rmmod bfa

Prevent module autoload

linux

Disable automatic loading of kernel modules

echo 'kernel.modules_disabled=1' >> /etc/sysctl.conf
sysctl -p

🧯 If You Can't Patch

Restrict local access to systems with bfa driver loaded
Monitor for kernel panic events and investigate root causes

🔍 How to Verify

Check if Vulnerable:

Check if bfa module is loaded: lsmod | grep bfa. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commits: uname -r and verify with distribution's security advisory. Confirm bfa module can be loaded/unloaded without crash.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or dmesg
OOM killer activity related to bfa driver
System crash/reboot events

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "double free") AND "bfa"

📊 Metadata

CVE ID: CVE-2025-38699

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

EPSS Score: 0.01% exploit probability (2.4th percentile)

Published: September 4, 2025

Last Updated: January 7, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable bfa driver

Prevent module autoload

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities