CVE-2025-40055: 
Linux Kernel vulnerability analysis and mitigation

A double free vulnerability (CVE-2025-40055) was discovered in the Linux kernel's OCFS2 filesystem component, specifically in the user_cluster_connect() function. The vulnerability was disclosed on October 28, 2025. The issue occurs when user_cluster_disconnect() frees 'conn->cc_private' (which is 'lc') and then the error handling code attempts to free 'lc' a second time (NVD).

The vulnerability exists in the error handling path of the user_cluster_connect() function within the OCFS2 filesystem code. The issue stems from improper memory management where the same memory location ('lc') is freed twice - once through conn->cc_private and again directly. This type of vulnerability is known as a double free condition, which can potentially lead to memory corruption (Ubuntu).

A double free vulnerability can potentially lead to memory corruption and could be exploited to cause system crashes or potentially achieve arbitrary code execution. The vulnerability affects multiple Linux distributions including Ubuntu and Debian, with Ubuntu assigning it a Medium priority rating (Ubuntu, Debian).

The vulnerability has been fixed by setting 'lc' to NULL after the first free operation to prevent the double free condition. Debian has released version 6.1.158-1 which includes the fix. Ubuntu has also released updates for affected kernel packages (Debian, Ubuntu).