# CVE-2025-39841: Linux Kernel lpfc use-after-free in deferred receive path

Source: https://junglewise.ai/threats/cve-2025-39841-linux-kernel-lpfc-use-after-free-in-deferred-receive-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-19. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2025-39841 · Severity: critical · CVSS 9.8 · Published 2025-09-19

A vulnerability exists in the Linux kernel's Emulex LightPulse Fibre Channel (lpfc) driver, which manages high-performance storage connections. A flaw in how the system handles data buffers could allow an attacker to trigger a system crash or potentially execute unauthorized code. This could lead to a total loss of system availability or the compromise of sensitive data stored on connected storage networks.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens RUGGEDCOM RST2428P](https://junglewise.ai/threats/technologies/ruggedcom-rst2428p), [Siemens SCALANCE XC-300](https://junglewise.ai/threats/technologies/scalance-xc-300), [Siemens SCALANCE XC-400](https://junglewise.ai/threats/technologies/scalance-xc-400), [Siemens SCALANCE XR-300](https://junglewise.ai/threats/technologies/scalance-xr-300), [Siemens SCALANCE XR-500 family](https://junglewise.ai/threats/technologies/scalance-xr-500), [Siemens SCALANCE XR-500WG](https://junglewise.ai/threats/technologies/scalance-xr-500wg). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-39841 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-39841 being exploited in the wild.

**How severe is CVE-2025-39841?** Critical severity, with a CVSS score of 9.8, published 19 September 2025.

**Which products and versions are affected?** Linux Kernel 5.1 to 5.4.299, 5.5 to 5.10.243, 5.11 to 5.15.192, 5.16 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.6; Linux Kernel n/a; Siemens RUGGEDCOM RST2428P < V3.3; Siemens SCALANCE XC-300 < V3.3.

**Is there a fix for CVE-2025-39841?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-39841 attacked?** It is attacked over the network or with local access, in an operating system.

**Am I affected by CVE-2025-39841?** Check whether you run Linux Kernel, Linux Kernel, Siemens RUGGEDCOM RST2428P or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the lpfc driver within the `lpfc_nvmet_defer_rcv` function. The root cause is an incorrect buffer release sequence where the Receive Queue (RQ) buffer was freed before the associated context pointer was cleared under a spinlock. This creates a race condition window where concurrent execution paths, such as ABTS or the repost path, could attempt to access or release the same pointer, resulting in a double-free or UAF. Attackers could potentially exploit this via network-based storage traffic to cause a kernel panic or achieve privilege escalation. Patches have been released for various stable kernel branches to ensure the pointer is detached under lock before the buffer is freed.

## Affected products

- Linux Linux Kernel n/a
- Siemens RUGGEDCOM RST2428P < V3.3
- Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < V3.3

## Timeline

- 2025-08-28: other: Patch submitted by developer
- 2025-09-19: disclosed: CVE published

## References

- [https://git.kernel.org/stable/c/367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11](https://git.kernel.org/stable/c/367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11)
- [https://git.kernel.org/stable/c/55658c7501467ca9ef3bd4453dd920010db8bc13](https://git.kernel.org/stable/c/55658c7501467ca9ef3bd4453dd920010db8bc13)
- [https://git.kernel.org/stable/c/897f64b01c1249ac730329b83f4f40bab71e86c7](https://git.kernel.org/stable/c/897f64b01c1249ac730329b83f4f40bab71e86c7)
- [https://git.kernel.org/stable/c/95b63d15fce5c54a73bbf195e1aacb5a75b128e2](https://git.kernel.org/stable/c/95b63d15fce5c54a73bbf195e1aacb5a75b128e2)
- [https://git.kernel.org/stable/c/9dba9a45c348e8460da97c450cddf70b2056deb3](https://git.kernel.org/stable/c/9dba9a45c348e8460da97c450cddf70b2056deb3)
- [https://git.kernel.org/stable/c/ab34084f42ee06a9028d67c78feafb911d33d111](https://git.kernel.org/stable/c/ab34084f42ee06a9028d67c78feafb911d33d111)
- [https://git.kernel.org/stable/c/baa39f6ad79d372a6ce0aa639fbb2f1578479f57](https://git.kernel.org/stable/c/baa39f6ad79d372a6ce0aa639fbb2f1578479f57)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback double unmap memory corruption](https://junglewise.ai/threats/cve-2026-99287-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)