CVE-2025-38289

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38289
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error handling. Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4f09940b5581e44069eb31a66cf7f05c3c35ed04 Patch
https://git.kernel.org/stable/c/b5162bb6aa1ec04dff4509b025883524b6d7e7ca Patch
https://git.kernel.org/stable/c/ea405fb4144985d5c60f49c2abd9ba47ea44fdb4 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

19 Nov 2025, 20:37

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/4f09940b5581e44069eb31a66cf7f05c3c35ed04 - () https://git.kernel.org/stable/c/4f09940b5581e44069eb31a66cf7f05c3c35ed04 - Patch
References () https://git.kernel.org/stable/c/b5162bb6aa1ec04dff4509b025883524b6d7e7ca - () https://git.kernel.org/stable/c/b5162bb6aa1ec04dff4509b025883524b6d7e7ca - Patch
References () https://git.kernel.org/stable/c/ea405fb4144985d5c60f49c2abd9ba47ea44fdb4 - () https://git.kernel.org/stable/c/ea405fb4144985d5c60f49c2abd9ba47ea44fdb4 - Patch

10 Jul 2025, 15:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/ea405fb4144985d5c60f49c2abd9ba47ea44fdb4 -

10 Jul 2025, 13:17

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Evitar un posible use-after-free de ndlp en dev_loss_tmo_callbk. Smatch detectó un posible use-after-free de un objeto ndlp en dev_loss_tmo_callbk durante la descarga del controlador o la gestión de errores fatales. Se solucionó reordenando el código para evitar un posible use-after-free si se eliminó previamente la referencia inicial a la lista de nodos.

10 Jul 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-10 08:15

Updated : 2025-11-19 20:37

NVD link : CVE-2025-38289

Mitre link : CVE-2025-38289

CVE.ORG link : CVE-2025-38289

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free