LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40055: ocfs2: fix double free in user_cluster_connect()

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-40055 is a Linux kernel OCFS2 filesystem bug. During an error path, the kernel can free the same private connection data twice. That can cause kernel memory corruption or instability on systems exercising this OCFS2 path. The provided sources do not include CVSS, exploitation evidence, or a named attacker prerequisite.

Executive priority

Treat as a targeted Linux kernel maintenance item, not an emergency based on current evidence. Patch through normal kernel security update cycles, faster for systems that use OCFS2 in production or handle critical storage workloads.

Technical view

In user_cluster_connect(), user_cluster_disconnect() frees conn->cc_private, which is the lc object. Error handling then frees lc again. The upstream fix sets lc to NULL on that path to prevent the second free. The record references multiple Linux stable commits and lists Linux kernel versions/branches as affected.

Likely exposure

Exposure is most relevant to Linux systems using or enabling OCFS2. Prioritize hosts with clustered filesystem use, kernel builds matching the CVE record, or kernels lacking the referenced stable commits. Evidence is insufficient to assess internet exposure or default exploitability.

Exploitation context

The source bundle marks KEV as false and provides no public exploitation claim. Double-free bugs can sometimes support denial of service or memory corruption, but the provided evidence does not establish exploitability, required privileges, or active attacks.

Researcher notes

Key uncertainty is exploitability. The record describes a double free on an OCFS2 error path but lacks CVSS, CWE, prerequisites, and impact detail. Analysis should focus on reachability of user_cluster_connect() and whether local privileges or OCFS2 configuration are required.

Mitigation direction

  • Review vendor kernel advisories for your distribution or appliance.
  • Upgrade to a kernel containing the referenced stable OCFS2 fix.
  • If OCFS2 is unused, disable or avoid loading it where operationally safe.
  • Track distribution backports; fixed package versions may differ from upstream versions.

Validation and detection

  • Inventory Linux hosts and identify kernels with OCFS2 enabled or loaded.
  • Compare running kernel source/package changelogs with the referenced stable commits.
  • Confirm whether distribution security advisories mention CVE-2025-40055.
  • Prioritize validation on clustered filesystem servers and storage nodes.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40055 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc994c2ebdbbc391a42f177c8eb7882ebf3f142d8, c994c2ebdbbc391a42f177c8eb7882ebf3f142d8, c994c2ebdbbc391a42f177c8eb7882ebf3f142d8, c994c2ebdbbc391a42f177c8eb7882ebf3f142d8, c994c2ebdbbc391a42f177c8eb7882ebf3f142d8, c994c2ebdbbc391a42f177c8eb7882ebf3f142d8, c994c2ebdbbc391a42f177c8eb7882ebf3f142d8, c994c2ebdbbc391a42f177c8eb7882ebf3f142d8unaffected
LinuxLinux3.14, 0, 5.4.301, 5.10.246, 5.15.195, 6.1.156, 6.6.112, 6.12.53, 6.17.3, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.