CVE-2025-39841 scsi: lpfc: Fix buffer free/clear order in deferred receive path
A use-after-free vulnerability in the Linux kernel's lpfc driver allows attackers to cause denial of service or execute arbitrary code via concurrent buffer operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39841?
CVE-2025-39841 is a critical use after free vulnerability in Debian Debian Linux, published on 19 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix buffer free/clear order in deferred receive path
Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF.
Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.
Weakness: CWE-787
Which versions are affected by CVE-2025-39841?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-39841?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-39841 being exploited?
There is no known exploitation of CVE-2025-39841 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-67538, AZL-74829, BELL-CVE-2025-39841, DEBIAN-CVE-2025-39841, GHSA-j8p6-qx4r-877v, ROOT-OS-DEBIAN-11-CVE-2025-39841 and 5 more.