CVE-2025-39841
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-09-19 16:15:42.813000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-39841",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-19T16:15:42.813",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix buffer free/clear order in deferred receive path\n\nFix a use-after-free window by correcting the buffer release sequence in\nthe deferred receive path. The code freed the RQ buffer first and only\nthen cleared the context pointer under the lock. Concurrent paths (e.g.,\nABTS and the repost path) also inspect and release the same pointer under\nthe lock, so the old order could lead to double-free/UAF.\n\nNote that the repost path already uses the correct pattern: detach the\npointer under the lock, then free it after dropping the lock. The\ndeferred path should do the same."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: lpfc: Corregir el orden de liberación/borrado del búfer en la ruta de recepción diferida\n\nCorregir una ventana de uso después de liberación corrigiendo la secuencia de liberación del búfer en la ruta de recepción diferida. El código liberaba primero el búfer RQ y solo entonces borraba el puntero de contexto bajo el bloqueo. Rutas concurrentes (p. ej., ABTS y la ruta de republicación) también inspeccionan y liberan el mismo puntero bajo el bloqueo, por lo que el orden antiguo podría llevar a una doble liberación/UAF.\n\nTenga en cuenta que la ruta de republicación ya utiliza el patrón correcto: desvincular el puntero bajo el bloqueo, luego liberarlo después de soltar el bloqueo. La ruta diferida debería hacer lo mismo."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/scsi/lpfc/lpfc_nvmet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
"lessThan": "ab34084f42ee06a9028d67c78feafb911d33d111",
"versionType": "git",
"status": "affected"
},
{
"version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
"lessThan": "baa39f6ad79d372a6ce0aa639fbb2f1578479f57",
"versionType": "git",
"status": "affected"
},
{
"version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
"lessThan": "95b63d15fce5c54a73bbf195e1aacb5a75b128e2",
"versionType": "git",
"status": "affected"
},
{
"version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
"lessThan": "55658c7501467ca9ef3bd4453dd920010db8bc13",
"versionType": "git",
"status": "affected"
},
{
"version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
"lessThan": "d96cc9a1b57725930c60b607423759d563b4d900",
"versionType": "git",
"status": "affected"
},
{
"version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
"lessThan": "367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11",
"versionType": "git",
"status": "affected"
},
{
"version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
"lessThan": "897f64b01c1249ac730329b83f4f40bab71e86c7",
"versionType": "git",
"status": "affected"
},
{
"version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
"lessThan": "9dba9a45c348e8460da97c450cddf70b2056deb3",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/scsi/lpfc/lpfc_nvmet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.1",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.1",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.299",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.243",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.192",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.151",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.105",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.46",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16.6",
"lessThanOrEqual": "6.16.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "RUGGEDCOM RST2428P",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XCH328",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XCM324",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XCM328",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XCM332",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (230 V AC, 12xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (230 V AC, 8xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (24 V DC, 12xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (24 V DC, 8xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SIMATIC CN 4100",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V5.0",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-10T20:42:00.721283Z",
"id": "CVE-2025-39841",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.1",
"versionEndExcluding": "5.4.299",
"matchCriteriaId": "B2628624-A7FD-440D-B999-D756AED08034"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "5.10.243",
"matchCriteriaId": "6DE4B49A-F1A3-4F0C-96D3-68676CE6BB4C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.192",
"matchCriteriaId": "8A911BD7-361F-45C0-A4A6-33FCBA0F6117"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.151",
"matchCriteriaId": "BC2D0B88-F133-4143-B91D-0A439AA143C0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.105",
"matchCriteriaId": "B9364B0C-6B18-422E-8254-73EF0E856875"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.46",
"matchCriteriaId": "F7E2B332-E920-4CAC-B400-288602DB6F16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.16.6",
"matchCriteriaId": "548F104C-0F08-438B-9C97-64C903F0C678"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
"matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
"matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
"matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/55658c7501467ca9ef3bd4453dd920010db8bc13",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/897f64b01c1249ac730329b83f4f40bab71e86c7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/95b63d15fce5c54a73bbf195e1aacb5a75b128e2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9dba9a45c348e8460da97c450cddf70b2056deb3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ab34084f42ee06a9028d67c78feafb911d33d111",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/baa39f6ad79d372a6ce0aa639fbb2f1578479f57",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d96cc9a1b57725930c60b607423759d563b4d900",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}