cbcvebase.
CVE-2025-38289
published 2025-07-10

CVE-2025-38289: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a…

PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.16%
5.9th percentile
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error handling. Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed.

Affected

20 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.12.37-1 (forky)linux 6.12.37-1 (forky)
linuxlinux
linuxlinux>= 4281f44ea8bfedd25938a0031bebba1473ece9ad < 4f09940b5581e44069eb31a66cf7f05c3c35ed044f09940b5581e44069eb31a66cf7f05c3c35ed04
linuxlinux>= 4281f44ea8bfedd25938a0031bebba1473ece9ad < b5162bb6aa1ec04dff4509b025883524b6d7e7cab5162bb6aa1ec04dff4509b025883524b6d7e7ca
linuxlinux>= 6.12.5 < 6.12.376.12.37
linuxlinux>= e4913d4bc59227fbdfe6b8f5541f49aaea1cb41c < ea405fb4144985d5c60f49c2abd9ba47ea44fdb4ea405fb4144985d5c60f49c2abd9ba47ea44fdb4
linuxlinux_kernel>= 0 < 6.12.37-16.12.37-1
linuxlinux_kernel>= 0 < 6.12.37-16.12.37-1
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 6.12.5 < 6.12.376.12.37
linuxlinux_kernel>= 6.13 < 6.15.36.15.3
ubuntulinux-aws
ubuntulinux-aws-6.8
ubuntulinux-gkeop
ubuntulinux-nvidia
ubuntulinux-nvidia-6.8
ubuntulinux-oracle
ubuntulinux-oracle-6.8
ubuntulinux-raspi-realtime
ubuntulinux-realtime

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
vendor_ubuntu3.2LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.