In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix buffer free/clear order in deferred receive path
Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF.
Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.
[
{
"deprecated": false,
"id": "CVE-2025-39841-04ba87b7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@897f64b01c1249ac730329b83f4f40bab71e86c7",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c",
"function": "lpfc_nvmet_defer_rcv"
},
"signature_type": "Function",
"digest": {
"function_hash": "19739992670827581857243730957228451868",
"length": 809.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-24c9f02f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9dba9a45c348e8460da97c450cddf70b2056deb3",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c",
"function": "lpfc_nvmet_defer_rcv"
},
"signature_type": "Function",
"digest": {
"function_hash": "19739992670827581857243730957228451868",
"length": 809.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-411a5b6b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9dba9a45c348e8460da97c450cddf70b2056deb3",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319114859546136742550724776497491852302",
"131019614860700879334968578726959951919",
"318867995718232656713568683219063873375",
"103883463816333852357584273197805321205",
"149629044001786766658573318098955480606",
"29961768278074846454568995986176148154",
"264632392743646735078744890066921587901",
"239589362584062504390136063686520190360",
"66380210700327175439341305499207897517",
"320862920571901861978017057688908038795",
"15926433087125886164340893991622398695",
"122128237793222835603225589884141232661",
"162731749813479386965388908440086841892",
"314740081351051756561388747048795114568",
"33694692450140688023815861736534550262",
"264574738906498035827905190260916857294",
"74821567347918453612227512442350464690",
"181221198816044176697304456058083772539",
"167309981290195337908895819507641534033",
"77781439002301053102668935770289203324"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-4564af13",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@897f64b01c1249ac730329b83f4f40bab71e86c7",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319114859546136742550724776497491852302",
"131019614860700879334968578726959951919",
"318867995718232656713568683219063873375",
"103883463816333852357584273197805321205",
"149629044001786766658573318098955480606",
"29961768278074846454568995986176148154",
"264632392743646735078744890066921587901",
"239589362584062504390136063686520190360",
"66380210700327175439341305499207897517",
"320862920571901861978017057688908038795",
"15926433087125886164340893991622398695",
"122128237793222835603225589884141232661",
"162731749813479386965388908440086841892",
"314740081351051756561388747048795114568",
"33694692450140688023815861736534550262",
"264574738906498035827905190260916857294",
"74821567347918453612227512442350464690",
"181221198816044176697304456058083772539",
"167309981290195337908895819507641534033",
"77781439002301053102668935770289203324"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-58a3c896",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d96cc9a1b57725930c60b607423759d563b4d900",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c",
"function": "lpfc_nvmet_defer_rcv"
},
"signature_type": "Function",
"digest": {
"function_hash": "19739992670827581857243730957228451868",
"length": 809.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-5d3a012c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c",
"function": "lpfc_nvmet_defer_rcv"
},
"signature_type": "Function",
"digest": {
"function_hash": "19739992670827581857243730957228451868",
"length": 809.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-6168705b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baa39f6ad79d372a6ce0aa639fbb2f1578479f57",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c",
"function": "lpfc_nvmet_defer_rcv"
},
"signature_type": "Function",
"digest": {
"function_hash": "19739992670827581857243730957228451868",
"length": 809.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-95f02cc0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab34084f42ee06a9028d67c78feafb911d33d111",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"186869055815260000454439902137319586461",
"282487835889367558320877932144381602809",
"155257329937627082854846870267542491166",
"103883463816333852357584273197805321205",
"149629044001786766658573318098955480606",
"29961768278074846454568995986176148154",
"264632392743646735078744890066921587901",
"239589362584062504390136063686520190360",
"66380210700327175439341305499207897517",
"320862920571901861978017057688908038795",
"15926433087125886164340893991622398695",
"122128237793222835603225589884141232661",
"162731749813479386965388908440086841892",
"314740081351051756561388747048795114568",
"33694692450140688023815861736534550262",
"264574738906498035827905190260916857294",
"74821567347918453612227512442350464690",
"181221198816044176697304456058083772539",
"167309981290195337908895819507641534033",
"115627863068543888177482925109015899474"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-baf5e01d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d96cc9a1b57725930c60b607423759d563b4d900",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319114859546136742550724776497491852302",
"131019614860700879334968578726959951919",
"318867995718232656713568683219063873375",
"103883463816333852357584273197805321205",
"149629044001786766658573318098955480606",
"29961768278074846454568995986176148154",
"264632392743646735078744890066921587901",
"239589362584062504390136063686520190360",
"66380210700327175439341305499207897517",
"320862920571901861978017057688908038795",
"15926433087125886164340893991622398695",
"122128237793222835603225589884141232661",
"162731749813479386965388908440086841892",
"314740081351051756561388747048795114568",
"33694692450140688023815861736534550262",
"264574738906498035827905190260916857294",
"74821567347918453612227512442350464690",
"181221198816044176697304456058083772539",
"167309981290195337908895819507641534033",
"77781439002301053102668935770289203324"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-ed9b4d68",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@baa39f6ad79d372a6ce0aa639fbb2f1578479f57",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319114859546136742550724776497491852302",
"131019614860700879334968578726959951919",
"318867995718232656713568683219063873375",
"103883463816333852357584273197805321205",
"149629044001786766658573318098955480606",
"29961768278074846454568995986176148154",
"264632392743646735078744890066921587901",
"239589362584062504390136063686520190360",
"66380210700327175439341305499207897517",
"320862920571901861978017057688908038795",
"15926433087125886164340893991622398695",
"122128237793222835603225589884141232661",
"162731749813479386965388908440086841892",
"314740081351051756561388747048795114568",
"33694692450140688023815861736534550262",
"264574738906498035827905190260916857294",
"74821567347918453612227512442350464690",
"181221198816044176697304456058083772539",
"167309981290195337908895819507641534033",
"77781439002301053102668935770289203324"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-edf5b259",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab34084f42ee06a9028d67c78feafb911d33d111",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c",
"function": "lpfc_nvmet_defer_rcv"
},
"signature_type": "Function",
"digest": {
"function_hash": "13336562263764570126209193477227693638",
"length": 803.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39841-f8f37458",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11",
"signature_version": "v1",
"target": {
"file": "drivers/scsi/lpfc/lpfc_nvmet.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319114859546136742550724776497491852302",
"131019614860700879334968578726959951919",
"318867995718232656713568683219063873375",
"103883463816333852357584273197805321205",
"149629044001786766658573318098955480606",
"29961768278074846454568995986176148154",
"264632392743646735078744890066921587901",
"239589362584062504390136063686520190360",
"66380210700327175439341305499207897517",
"320862920571901861978017057688908038795",
"15926433087125886164340893991622398695",
"122128237793222835603225589884141232661",
"162731749813479386965388908440086841892",
"314740081351051756561388747048795114568",
"33694692450140688023815861736534550262",
"264574738906498035827905190260916857294",
"74821567347918453612227512442350464690",
"181221198816044176697304456058083772539",
"167309981290195337908895819507641534033",
"77781439002301053102668935770289203324"
]
}
}
]