Linux Kernel up to 6.12.51/6.16.11/6.17.1 dbitmap_grow double free

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.12.51/6.16.11/6.17.1. Affected by this vulnerability is the function dbitmap_grow. Executing a manipulation can lead to double free. This vulnerability is registered as CVE-2025-40028. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel up to 6.12.51/6.16.11/6.17.1. This vulnerability affects the function dbitmap_grow. The manipulation with an unknown input leads to a double free vulnerability. The CWE definition for the vulnerability is CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: binder: fix double-free in dbitmap A process might fail to allocate a new bitmap when trying to expand its proc->dmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error: ================================================================== BUG: KASAN: double-free in binder_proc_dec_tmpref+0x2e0/0x55c Free of addr ffff00000b7c1420 by task kworker/9:1/209 CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: kfree+0x164/0x31c binder_proc_dec_tmpref+0x2e0/0x55c binder_deferred_func+0xc24/0x1120 process_one_work+0x520/0xba4 [...] Allocated by task 448: __kmalloc_noprof+0x178/0x3c0 bitmap_zalloc+0x24/0x30 binder_open+0x14c/0xc10 [...] Freed by task 449: kfree+0x184/0x31c binder_inc_ref_for_node+0xb44/0xe44 binder_transaction+0x29b4/0x7fbc binder_thread_write+0x1708/0x442c binder_ioctl+0x1b50/0x2900 [...] ================================================================== Fix this issue by marking proc->map NULL in dbitmap_free().

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2025-40028 since 04/16/2025. The exploitation appears to be difficult. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/27/2026).

The vulnerability scanner Nessus provides a plugin with the ID 271895 (Linux Distros Unpatched Vulnerability : CVE-2025-40028), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.12.52, 6.16.12, 6.17.2 or 6.18-rc1 eliminates this vulnerability. Applying the patch c301ec61ce6f16e21a36b99225ca8a20c1591e10/0390633979969c54c0ce6a198d6f45cdbe2c84b1/b781e5635a3398e2b64440371233c2c5102cd6cb/3ebcd3460cad351f198c39c6edb4af519a0ed934 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (271895) and CERT Bund (WID-SEC-2025-2430). Once again VulDB remains the best source for vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• NetApp ActiveIQ Unified Manager
• Open Source Linux Kernel
• Microsoft Azure

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4
• 6.12.5
• 6.12.6
• 6.12.7
• 6.12.8
• 6.12.9
• 6.12.10
• 6.12.11
• 6.12.12
• 6.12.13
• 6.12.14
• 6.12.15
• 6.12.16
• 6.12.17
• 6.12.18
• 6.12.19
• 6.12.20
• 6.12.21
• 6.12.22
• 6.12.23
• 6.12.24
• 6.12.25
• 6.12.26
• 6.12.27
• 6.12.28
• 6.12.29
• 6.12.30
• 6.12.31
• 6.12.32
• 6.12.33
• 6.12.34
• 6.12.35
• 6.12.36
• 6.12.37
• 6.12.38
• 6.12.39
• 6.12.40
• 6.12.41
• 6.12.42
• 6.12.43
• 6.12.44
• 6.12.45
• 6.12.46
• 6.12.47
• 6.12.48
• 6.12.49
• 6.12.50
• 6.12.51
• 6.16.0
• 6.16.1
• 6.16.2
• 6.16.3
• 6.16.4
• 6.16.5
• 6.16.6
• 6.16.7
• 6.16.8
• 6.16.9
• 6.16.10
• 6.16.11
• 6.17.0
• 6.17.1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion