In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
If a call to lpfcsli4readrev() from lpfcsli4hbasetup() fails, the resultant cleanup routine lpfcsli4vportdeletefcpxriaborted() may occur before sli4hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abtsiobuflistlock for the first hardware queue. Fix by adding a null ptr check on phba->sli4hba.hdwq and early return because this situation means there must have been an error during port initialization.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38695.json"
}[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"278474544082634213335282133034407467891",
"103329580971664790830453000568097834492",
"261689672156069720524585137904739605458"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-38695-a0d3667f",
"target": {
"file": "drivers/scsi/lpfc/lpfc_scsi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74bdf54a847dab209d2a8f65852f59b7fa156175"
},
{
"signature_version": "v1",
"digest": {
"length": 729.0,
"function_hash": "162536273718068694674529496969175413567"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38695-e0879c48",
"target": {
"function": "lpfc_sli4_vport_delete_fcp_xri_aborted",
"file": "drivers/scsi/lpfc/lpfc_scsi.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74bdf54a847dab209d2a8f65852f59b7fa156175"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38695.json"