Riskcovery

CVE-2025-38289

scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk

State
Published
Severity
Not scored
Published
Jul 10, 2025
Updated
May 23, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk

Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error handling.

Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e4913d4bc59227fbdfe6b8f5541f49aaea1cb41c to before ea405fb4144985d5c60f49c2abd9ba47ea44fdb4Affected
  • 4281f44ea8bfedd25938a0031bebba1473ece9ad to before 4f09940b5581e44069eb31a66cf7f05c3c35ed04Affected
  • 4281f44ea8bfedd25938a0031bebba1473ece9ad to before b5162bb6aa1ec04dff4509b025883524b6d7e7caAffected
  • 6.12.5 to before 6.12.37Affected
LinuxLinux
  • 6.13Affected
  • before 6.13Not affected
  • 6.12.37 through 6.12.*Not affected
  • 6.15.3 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.