CVE-2025-39841
HIGHLinux Kernel 5.1-6.16.5 - Use-After-Free in SCSI lpfc Deferred Receive Path
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.
References (12)
Core 12
Core References
Third Party Advisory, Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Third Party Advisory, Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-089022.html
Scores
CVSS v3
7.8
EPSS
0.0002
EPSS Percentile
5.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-787
Status
published
Products (28)
debian/debian_linux
11.0
linux/Kernel
5.1.0 - 5.4.299linux
linux/Kernel
5.11.0 - 5.15.192linux
linux/Kernel
5.16.0 - 6.1.151linux
linux/Kernel
5.5.0 - 5.10.243linux
linux/Kernel
6.13.0 - 6.16.6linux
linux/Kernel
6.2.0 - 6.6.105linux
linux/Kernel
6.7.0 - 6.12.46linux
Linux/Linux
< 5.1
Linux/Linux
472e146d1cf3410a898b49834500fa9e33ac41a2 - 367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11
... and 18 more
Published
Sep 19, 2025
Tracked Since
Feb 18, 2026