CVE-2025-71075

scsi: aic94xx: fix use-after-free in device removal path

State: Published
Severity: Not scored
Published: Jan 13, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: aic94xx: fix use-after-free in device removal path

The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability.

When a device removal is triggered (via hot-unplug or module unload), race condition can occur.

The fix adds tasklet_kill() before freeing the asd_ha structure, ensuring all scheduled tasklets complete before cleanup proceeds.

Scores

The record has no CVSS score.

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	2908d778ab3e244900c310974e1fc1c69066e450 to before c8f6f88cd1df35155258285c4f43268b361819dfAffected 2908d778ab3e244900c310974e1fc1c69066e450 to before 278455a82245a572aeb218a6212a416a98e418deAffected 2908d778ab3e244900c310974e1fc1c69066e450 to before b3e655e52b98a1d3df41c8e42035711e083099f8Affected 2908d778ab3e244900c310974e1fc1c69066e450 to before e354793a7ab9bb0934ea699a9d57bcd1b48fc27bAffected 2908d778ab3e244900c310974e1fc1c69066e450 to before a41dc180b6e1229ae49ca290ae14d82101c148c3Affected 2908d778ab3e244900c310974e1fc1c69066e450 to before 751c19635c2bfaaf2836a533caa3663633066dcfAffected 2908d778ab3e244900c310974e1fc1c69066e450 to before f6ab594672d4cba08540919a4e6be2e202b60007Affected
LinuxLinux	2.6.19Affected before 2.6.19Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.3 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

2908d778ab3e244900c310974e1fc1c69066e450 to before c8f6f88cd1df35155258285c4f43268b361819dfAffected
2908d778ab3e244900c310974e1fc1c69066e450 to before 278455a82245a572aeb218a6212a416a98e418deAffected
2908d778ab3e244900c310974e1fc1c69066e450 to before b3e655e52b98a1d3df41c8e42035711e083099f8Affected
2908d778ab3e244900c310974e1fc1c69066e450 to before e354793a7ab9bb0934ea699a9d57bcd1b48fc27bAffected
2908d778ab3e244900c310974e1fc1c69066e450 to before a41dc180b6e1229ae49ca290ae14d82101c148c3Affected
2908d778ab3e244900c310974e1fc1c69066e450 to before 751c19635c2bfaaf2836a533caa3663633066dcfAffected
2908d778ab3e244900c310974e1fc1c69066e450 to before f6ab594672d4cba08540919a4e6be2e202b60007Affected

LinuxLinux

2.6.19Affected
before 2.6.19Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.3 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.