Login Request a demo
High severity · published Sep 19, 2025
CVE-2025-39841
scsi: lpfc: Fix buffer free/clear order in deferred receive path
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
5.1 before 5.4.299; 5.5 before 5.10.243; 5.11 before 5.15.192; 5.16 before 6.1.151; 6.2 before 6.6.105; 6.7 before 6.12.46; +5 more · source: NVD
LI
Linux · Linux
472e146d1cf3410a898b49834500fa9e33ac41a2 before ab34084f42ee06a9028d67c78feafb911d33d111; 472e146d1cf3410a898b49834500fa9e33ac41a2 before baa39f6ad79d372a6ce0aa639fbb2f1578479f57; 472e146d1cf3410a898b49834500fa9e33ac41a2 before 95b63d15fce5c54a73bbf195e1aacb5a75b128e2; 472e146d1cf3410a898b49834500fa9e33ac41a2 before 55658c7501467ca9ef3bd4453dd920010db8bc13; 472e146d1cf3410a898b49834500fa9e33ac41a2 before d96cc9a1b57725930c60b607423759d563b4d900; 472e146d1cf3410a898b49834500fa9e33ac41a2 before 367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11; +3 more · source: vendor
DL
Debian Linux · Debian
11.0 · source: NVD
RR
RUGGEDCOM RST2428P · Siemens
before V3.3 · source: CISA
SX
SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCH328 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM324 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM328 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM332 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRH334 (24 V DC, 8xFO, CC) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230 V AC, 12xFO) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230 V AC, 8xFO) · Siemens
before V3.3 · source: CISA
In the news
VulnerabilityHigh
Siemens SINEC OS
View CSAF Summary SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SINEC OS are affected: RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665, CVE-2025-0725, CVE-2025-1390, CVE-2025-3360, CVE-2025-4138, CVE-2025-4330, CVE-2025-4373, CVE-2025-4435, CVE-2025-4516, CVE-2025-4517, CVE-2025-6141, CVE-2025-9086, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-10148, CVE-2025-27587, CVE-2025-32433, CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38345, CVE-2025-38350, CVE-2025-38498, CVE-2025-39839, CVE-2025-39841, CVE-2025-39846, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-59375) SCALANCE XCH328 (6GK5328-4TS01-2EC2) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665...
CVE-2022-48174CVE-2023-7256CVE-2023-39810
Feb 12, 2026·CISA Advisories
Affected product
KE
Kernel
Linux
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-39841
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-39841
Patch
https://git.kernel.org/stable/c/367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11
Patch
https://git.kernel.org/stable/c/55658c7501467ca9ef3bd4453dd920010db8bc13
Patch
https://git.kernel.org/stable/c/897f64b01c1249ac730329b83f4f40bab71e86c7
Patch
https://git.kernel.org/stable/c/95b63d15fce5c54a73bbf195e1aacb5a75b128e2
Patch
https://git.kernel.org/stable/c/9dba9a45c348e8460da97c450cddf70b2056deb3
Patch
https://git.kernel.org/stable/c/ab34084f42ee06a9028d67c78feafb911d33d111
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability