#VU108816 Double free in Linux kernel - CVE-2025-37819

Vulnerability identifier: #VU108816

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37819

CWE-ID: CWE-415

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the gicv2m_of_init() function in drivers/irqchip/irq-gic-v2m.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.14, 6.14.1, 6.14.2, 6.14.3, 6.14.4

---

External links
https://git.kernel.org/stable/c/2f2803e4b5e4df2b08d378deaab78b1681ef9b30
https://git.kernel.org/stable/c/3318dc299b072a0511d6dfd8367f3304fb6d9827
https://git.kernel.org/stable/c/3939d6f29d34cdb60e3f68b76e39e00a964a1d51
https://git.kernel.org/stable/c/47bee0081b483b077c7560bc5358ad101f89c8ef
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14.5

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.