CVE-2025-38289
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38289
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38289.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-38289
- Downstream
- Related
- Published
- 2025-07-10T07:42:05Z
- Modified
- 2025-10-22T13:15:18.678799Z
- Summary
- scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Avoid potential ndlp use-after-free in devlosstmo_callbk
Smatch detected a potential use-after-free of an ndlp oject in devlosstmo_callbk during driver unload or fatal error handling.
Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede4913d4bc59227fbdfe6b8f5541f49aaea1cb41cFixedea405fb4144985d5c60f49c2abd9ba47ea44fdb4
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4281f44ea8bfedd25938a0031bebba1473ece9adFixed4f09940b5581e44069eb31a66cf7f05c3c35ed04
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced4281f44ea8bfedd25938a0031bebba1473ece9adFixedb5162bb6aa1ec04dff4509b025883524b6d7e7ca
Affected versions
v6.*
v6.12
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.20
v6.12.21
v6.12.22
v6.12.23
v6.12.24
v6.12.25
v6.12.26
v6.12.27
v6.12.28
v6.12.29
v6.12.30
v6.12.31
v6.12.32
v6.12.33
v6.12.34
v6.12.35
v6.12.36
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.14
v6.14-rc1
v6.14-rc2
v6.14-rc3
v6.14-rc4
v6.14-rc5
v6.14-rc6
v6.14-rc7
v6.15
v6.15-rc1
v6.15-rc2
v6.15-rc3
v6.15-rc4
v6.15-rc5
v6.15-rc6
v6.15-rc7
v6.15.1
v6.15.2
Database specific
vanir_signatures
[
{
"id": "CVE-2025-38289-9594ab2c",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"107826329200448309000358014350024259430",
"290146375095453839566922510414167778517",
"181275072619590369573114534744108240388",
"168114463619969142942113555759345711685",
"99017275328554017666954621310870662229",
"99942024841467970072498068877671988404",
"130963393863595400637810948494710663116",
"34290163259791622967474726858797276993",
"207280345102280614348187352160835444698",
"190720559207585251224778186604658536447",
"117536888700695426973357321713286008754",
"247421434889220001002016025209939502068",
"339153968634145123149251699870842154775",
"156681553368997963929192418130780641208",
"251017947119893783652864073266034520063",
"170735749926445889114981766199683350336",
"296517783864484078911940685753092657828",
"67444384318940137321025103284989652720",
"241737604554190981498125496048652131364",
"201555548456842743607225800017335626609",
"2179571878404171842086523456954153959",
"277693504032453716753628828419430359160"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5162bb6aa1ec04dff4509b025883524b6d7e7ca",
"target": {
"file": "drivers/scsi/lpfc/lpfc_hbadisc.c"
}
},
{
"id": "CVE-2025-38289-9e9c16c9",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3252.0,
"function_hash": "155267500694629485704122080490599727880"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f09940b5581e44069eb31a66cf7f05c3c35ed04",
"target": {
"function": "lpfc_dev_loss_tmo_callbk",
"file": "drivers/scsi/lpfc/lpfc_hbadisc.c"
}
},
{
"id": "CVE-2025-38289-cc7eaa81",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"107826329200448309000358014350024259430",
"290146375095453839566922510414167778517",
"181275072619590369573114534744108240388",
"168114463619969142942113555759345711685",
"99017275328554017666954621310870662229",
"99942024841467970072498068877671988404",
"130963393863595400637810948494710663116",
"34290163259791622967474726858797276993",
"207280345102280614348187352160835444698",
"190720559207585251224778186604658536447",
"117536888700695426973357321713286008754",
"247421434889220001002016025209939502068",
"339153968634145123149251699870842154775",
"156681553368997963929192418130780641208",
"251017947119893783652864073266034520063",
"170735749926445889114981766199683350336",
"296517783864484078911940685753092657828",
"67444384318940137321025103284989652720",
"241737604554190981498125496048652131364",
"201555548456842743607225800017335626609",
"2179571878404171842086523456954153959",
"277693504032453716753628828419430359160"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f09940b5581e44069eb31a66cf7f05c3c35ed04",
"target": {
"file": "drivers/scsi/lpfc/lpfc_hbadisc.c"
}
},
{
"id": "CVE-2025-38289-d16076b9",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 3252.0,
"function_hash": "155267500694629485704122080490599727880"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5162bb6aa1ec04dff4509b025883524b6d7e7ca",
"target": {
"function": "lpfc_dev_loss_tmo_callbk",
"file": "drivers/scsi/lpfc/lpfc_hbadisc.c"
}
}
]