CVE-2025-39841: Linux Kernel lpfc use-after-free in deferred receive path

CVE-2025-39841 · Severity: critical · CVSS 9.8 · Published 2025-09-19

Technologies: Siemens RUGGEDCOM RST2428P, Siemens SCALANCE XC-300, Linux Kernel, Siemens SCALANCE XR-500WG, Siemens SCALANCE XR-500 family, Siemens SCALANCE XR-300, Siemens SCALANCE XC-400. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's Emulex LightPulse Fibre Channel (lpfc) driver, which manages high-performance storage connections. A flaw in how the system handles data buffers could allow an attacker to trigger a system crash or potentially execute unauthorized code. This could lead to a total loss of system availability or the compromise of sensitive data stored on connected storage networks.

Technical details

A use-after-free (UAF) vulnerability exists in the lpfc driver within the `lpfc_nvmet_defer_rcv` function. The root cause is an incorrect buffer release sequence where the Receive Queue (RQ) buffer was freed before the associated context pointer was cleared under a spinlock. This creates a race condition window where concurrent execution paths, such as ABTS or the repost path, could attempt to access or release the same pointer, resulting in a double-free or UAF. Attackers could potentially exploit this via network-based storage traffic to cause a kernel panic or achieve privilege escalation. Patches have been released for various stable kernel branches to ensure the pointer is detached under lock before the buffer is freed.

CVE-2025-39841: Linux Kernel lpfc use-after-free in deferred receive path

Executive brief

Technical details

Affected products

Timeline

References

Related threats