CVE-2025-39841

HIGH

Linux Kernel 5.1-6.16.5 - Use-After-Free in SCSI lpfc Deferred Receive Path

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.

Scores

CVSS v3 7.8
EPSS 0.0002
EPSS Percentile 5.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (28)
debian/debian_linux 11.0
linux/Kernel 5.1.0 - 5.4.299linux
linux/Kernel 5.11.0 - 5.15.192linux
linux/Kernel 5.16.0 - 6.1.151linux
linux/Kernel 5.5.0 - 5.10.243linux
linux/Kernel 6.13.0 - 6.16.6linux
linux/Kernel 6.2.0 - 6.6.105linux
linux/Kernel 6.7.0 - 6.12.46linux
Linux/Linux < 5.1
Linux/Linux 472e146d1cf3410a898b49834500fa9e33ac41a2 - 367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11
... and 18 more
Published Sep 19, 2025
Tracked Since Feb 18, 2026