Not yet scoredPublished Oct 28, 2025

CVE-2025-40055ocfs2: fix double free in user_cluster_connect()

Updated under an hour ago (Oct 27, 2026, 8:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on this path to avoid a double free.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 before 283333079d96c84baa91f0c62b5e0cbec246b7a2; from c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 before f992bc72f681c32a682d474a29c2135a64d4f4e5; from c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 before 827c8efa0d1afe817b90f3618afff552e88348d2; from c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 before bfe011297ddd2d0cd64752978baaa0c04cd20573; from c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 before 7e76fe9dfadbc00364d7523d5a109e9d3e4a7db2; from c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 before 694d5b401036a614f8080085a9de6f86ff0742dc; from c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 before 892f41e12c8689130d552a9eb2b77bafd26484ab; from c994c2ebdbbc391a42f177c8eb7882ebf3f142d8 before 8f45f089337d924db24397f55697cda0e6960516	CNA record

References

References

https://git.kernel.org/stable/c/283333079d96c84baa91f0c62b5e0cbec246b7a2
https://git.kernel.org/stable/c/f992bc72f681c32a682d474a29c2135a64d4f4e5
https://git.kernel.org/stable/c/827c8efa0d1afe817b90f3618afff552e88348d2
https://git.kernel.org/stable/c/bfe011297ddd2d0cd64752978baaa0c04cd20573
https://git.kernel.org/stable/c/7e76fe9dfadbc00364d7523d5a109e9d3e4a7db2
https://git.kernel.org/stable/c/694d5b401036a614f8080085a9de6f86ff0742dc
https://git.kernel.org/stable/c/892f41e12c8689130d552a9eb2b77bafd26484ab
https://git.kernel.org/stable/c/8f45f089337d924db24397f55697cda0e6960516

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.