CVE-2025-39841Out-of-bounds Write in Linux

Severity
7.8HIGHNVD
EPSS
0.0%
top 96.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 19
Latest updateApr 9

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the r

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

NVDlinux/linux_kernel5.15.4.299+7
Debianlinux/linux_kernel< 5.10.244-1+3
CVEListV5linux/linux472e146d1cf3410a898b49834500fa9e33ac41a2ab34084f42ee06a9028d67c78feafb911d33d111+8

Also affects: Debian Linux 11.0

Patches

🔴Vulnerability Details

3
GHSA
GHSA-j8p6-qx4r-877v: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after2025-09-22
OSV
CVE-2025-39841: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-f2025-09-19
CVEList
scsi: lpfc: Fix buffer free/clear order in deferred receive path2025-09-19

📋Vendor Advisories

21
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities2026-04-09
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities2026-04-01
Ubuntu
Linux kernel (Azure) vulnerabilities2026-03-25
Ubuntu
Linux kernel (Azure) vulnerabilities2026-03-25
Ubuntu
Linux kernel (AWS) vulnerabilities2026-03-23
CVE-2025-39841 — Out-of-bounds Write in Linux | cvebase