In the Linux kernel, the following vulnerability has been resolved:
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
During mpt3sastransportportremove(), messages were logged with devprintk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device.
Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal.
[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOTMODULE, [E]=UNSIGNEDMODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:_devprintk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 [83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 [83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 [83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 [83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 [83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 [83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 [83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 [83428.295844] PKRU: 55555554 [83428.295846] Call Trace: [83428.295848] <TASK> [83428.295850] devprintk+0x5c/0x80 [83428.295857] ? srsoaliasreturnthunk+0x5/0xfbef5 [83428.295863] mpt3sastransportportremove+0x1c7/0x420 [mpt3sas] [83428.295882] scsihremovedevice+0x21b/0x280 [mpt3sas] [83428.295894] ? _scsihexpandernoderemove+0x108/0x140 [mpt3sas] [83428.295906] ? srsoaliasreturnthunk+0x5/0xfbef5 [83428.295910] mpt3sasdeviceremovebysasaddress.part.0+0x8f/0x110 [mpt3sas] [83428.295921] scsihexpandernoderemove+0x129/0x140 [mpt3sas] [83428.295933] scsihexpandernoderemove+0x6a/0x140 [mpt3sas] [83428.295944] scsihremove+0x3f0/0x4a0 [mpt3sas] [83428.295957] pcideviceremove+0x3b/0xb0 [83428.295962] devicereleasedriverinternal+0x193/0x200 [83428.295968] driverdetach+0x44/0x90 [83428.295971] busremovedriver+0x69/0xf0 [83428.295975] pciunregisterdriver+0x2a/0xb0 [83428.295979] _mpt3sasexit+0x1f/0x300 [mpt3sas] [83428.295991] _dosysdeletemodule.constprop.0+0x174/0x310 [83428.295997] ? srsoaliasreturnthunk+0x5/0xfbef5 [83428.296000] ? _x64sysgetdents64+0x9a/0x110 [83428.296005] ? srsoaliasreturnthunk+0x5/0xfbef5 [83428.296009] ? syscalltraceenter+0xf6/0x1b0 [83428.296014] dosyscall64+0x7b/0x2c0 [83428.296019] ? srsoaliasreturnthunk+0x5/0xfbef5 [83428.296023] entrySYSCALL64afterhwframe+0x76/0x7e
[
{
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40115-0949497c",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa153fb40c61f8ca01237427c97a0b93ba32c403",
"digest": {
"line_hashes": [
"325291429666896826634120184202728863658",
"205919536283307585541067528007088701549",
"60534268301907391627203871327064934432",
"26339516137897998301578648898605808235",
"162664814775171856214970453195694492881",
"73540796304590255566747015418346476623",
"224530014252788323929915218699612011215",
"52811646909424332654890726898736603286"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40115-0e2abeb2",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c",
"function": "mpt3sas_transport_port_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fd39e14d47d9b4965dd5c9cff16e64ba3e71a62",
"digest": {
"function_hash": "11190860397601976327916718289649574853",
"length": 2583.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40115-0e83afa9",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c",
"function": "mpt3sas_transport_port_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa153fb40c61f8ca01237427c97a0b93ba32c403",
"digest": {
"function_hash": "11190860397601976327916718289649574853",
"length": 2583.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40115-10fd7bce",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c",
"function": "mpt3sas_transport_port_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a89253eb4e648deace48a4e38996afd182eb95e3",
"digest": {
"function_hash": "11190860397601976327916718289649574853",
"length": 2583.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40115-4ddda43b",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3a6d153861d0f29b80882470d14aafb8d687dc2",
"digest": {
"line_hashes": [
"325291429666896826634120184202728863658",
"205919536283307585541067528007088701549",
"60534268301907391627203871327064934432",
"26339516137897998301578648898605808235",
"162664814775171856214970453195694492881",
"73540796304590255566747015418346476623",
"224530014252788323929915218699612011215",
"52811646909424332654890726898736603286"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40115-51126d83",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c",
"function": "mpt3sas_transport_port_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e1442bae50ed633c2fe8058f47cd79b4ad88b9b",
"digest": {
"function_hash": "14182526054812170368630043283605167792",
"length": 1441.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40115-63268864",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c",
"function": "mpt3sas_transport_port_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6459dba4f35017448535a799cf699d5205eb5489",
"digest": {
"function_hash": "11190860397601976327916718289649574853",
"length": 2583.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40115-679fda08",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c",
"function": "mpt3sas_transport_port_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1703fe4f8ae50d1fb6449854e1fcaed1053e3a14",
"digest": {
"function_hash": "11190860397601976327916718289649574853",
"length": 2583.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40115-6d4ff9f7",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c",
"function": "mpt3sas_transport_port_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3a6d153861d0f29b80882470d14aafb8d687dc2",
"digest": {
"function_hash": "53610656878765637451028086900980167954",
"length": 1343.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40115-985a8362",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6459dba4f35017448535a799cf699d5205eb5489",
"digest": {
"line_hashes": [
"325291429666896826634120184202728863658",
"205919536283307585541067528007088701549",
"60534268301907391627203871327064934432",
"26339516137897998301578648898605808235",
"162664814775171856214970453195694492881",
"73540796304590255566747015418346476623",
"224530014252788323929915218699612011215",
"52811646909424332654890726898736603286"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40115-ae20ed9f",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a89253eb4e648deace48a4e38996afd182eb95e3",
"digest": {
"line_hashes": [
"325291429666896826634120184202728863658",
"205919536283307585541067528007088701549",
"60534268301907391627203871327064934432",
"26339516137897998301578648898605808235",
"162664814775171856214970453195694492881",
"73540796304590255566747015418346476623",
"224530014252788323929915218699612011215",
"52811646909424332654890726898736603286"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-40115-bb5f80ce",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c",
"function": "mpt3sas_transport_port_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@970ceb1bdc3d6c2af9245d6eca38606e74fcb6b8",
"digest": {
"function_hash": "11190860397601976327916718289649574853",
"length": 2583.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40115-c1aa5c37",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@970ceb1bdc3d6c2af9245d6eca38606e74fcb6b8",
"digest": {
"line_hashes": [
"325291429666896826634120184202728863658",
"205919536283307585541067528007088701549",
"60534268301907391627203871327064934432",
"26339516137897998301578648898605808235",
"162664814775171856214970453195694492881",
"73540796304590255566747015418346476623",
"224530014252788323929915218699612011215",
"52811646909424332654890726898736603286"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40115-d69cb06d",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e1442bae50ed633c2fe8058f47cd79b4ad88b9b",
"digest": {
"line_hashes": [
"325291429666896826634120184202728863658",
"205919536283307585541067528007088701549",
"60534268301907391627203871327064934432",
"26339516137897998301578648898605808235",
"162664814775171856214970453195694492881",
"73540796304590255566747015418346476623",
"224530014252788323929915218699612011215",
"52811646909424332654890726898736603286"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40115-d7021bbb",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1703fe4f8ae50d1fb6449854e1fcaed1053e3a14",
"digest": {
"line_hashes": [
"325291429666896826634120184202728863658",
"205919536283307585541067528007088701549",
"60534268301907391627203871327064934432",
"26339516137897998301578648898605808235",
"162664814775171856214970453195694492881",
"73540796304590255566747015418346476623",
"224530014252788323929915218699612011215",
"52811646909424332654890726898736603286"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-40115-d76aa905",
"target": {
"file": "drivers/scsi/mpt3sas/mpt3sas_transport.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fd39e14d47d9b4965dd5c9cff16e64ba3e71a62",
"digest": {
"line_hashes": [
"325291429666896826634120184202728863658",
"205919536283307585541067528007088701549",
"60534268301907391627203871327064934432",
"26339516137897998301578648898605808235",
"162664814775171856214970453195694492881",
"73540796304590255566747015418346476623",
"224530014252788323929915218699612011215",
"52811646909424332654890726898736603286"
],
"threshold": 0.9
},
"signature_version": "v1"
}
]