{
  "cveId": "CVE-2025-40028",
  "url": "https://patchblox.com/security/cve/CVE-2025-40028",
  "summary": "CVE-2025-40028 is fixed in linux on 1 platform, first by DEBIAN-CVE-2025-40028, released October 28, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  binder: fix double-free in dbitmap  A process mi...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  binder: fix double-free in dbitmap  A process might fail to allocate a new bitmap when trying to expand its proc-\u003Edmap. In that case, dbitmap_grow() fails and frees the old bitmap via dbitmap_free(). However, the driver calls dbitmap_free() again when the same process terminates, leading to a double-free error:    ==================================================================   BUG: KASAN: double-free in binder_proc_dec_tmpref\u002B0x2e0/0x55c   Free of addr ffff00000b7c1420 by task kworker/9:1/209    CPU: 9 UID: 0 PID: 209 Comm: kworker/9:1 Not tainted 6.17.0-rc6-dirty #5 PREEMPT   Hardware name: linux,dummy-virt (DT)   Workqueue: events binder_deferred_func   Call trace:    kfree\u002B0x164/0x31c    binder_proc_dec_tmpref\u002B0x2e0/0x55c    binder_deferred_func\u002B0xc24/0x1120    process_one_work\u002B0x520/0xba4   [...]    Allocated by task 448:    __kmalloc_noprof\u002B0x178/0x3c0    bitmap_zalloc\u002B0x24/0x30    binder_open\u002B0x14c/0xc10   [...]    Freed by task 449:    kfree\u002B0x184/0x31c    binder_inc_ref_for_node\u002B0xb44/0xe44    binder_transaction\u002B0x29b4/0x7fbc    binder_thread_write\u002B0x1708/0x442c    binder_ioctl\u002B0x1b50/0x2900   [...]   ==================================================================  Fix this issue by marking proc-\u003Emap NULL in dbitmap_free().",
  "published": "2025-10-28T10:15:42Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00154,
  "epssPercentile": 0.0454,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.57-1",
      "fix": "DEBIAN-CVE-2025-40028",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40028",
      "released": "2025-10-28T10:15:42Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.17.6-1",
      "fix": "DEBIAN-CVE-2025-40028",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40028",
      "released": "2025-10-28T10:15:42Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}