Executive brief
A vulnerability in the Linux kernel's smartpqi storage driver could allow a local user to cause a system crash or unpredictable behavior. The issue occurs when the system attempts to reset a storage device at the same time the device is being removed, leading to the use of memory that has already been freed. This primarily impacts system stability and availability in environments using specific Microchip storage controllers.
Technical details
A race condition exists in the smartpqi driver (drivers/scsi/smartpqi/smartpqi_init.c) between the LUN reset handler and device removal via sdev_destroy(). An abort handler may schedule a LUN reset work item that executes after the device has been removed and its resources freed, resulting in a use-after-free (UAF). The fix introduces a check in the reset handler to verify the device's presence in the SCSI device list, ensures pending Task Management Function (TMF) work is canceled during destruction, and synchronizes device freeing using the LUN reset mutex. This vulnerability requires local access and specific timing to exploit.
Affected products
- Linux Linux Kernel 6.0 to 6.1.160, 6.6.x, 6.11.x, 6.12.x
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2024-12-24: advisory: Initial CVE publication
- 2025-11-06: patched: Fix committed to Linux kernel source
References
- https://git.kernel.org/stable/c/1a5c5a2f88e839af5320216a02ffb075b668596a
- https://git.kernel.org/stable/c/4e1acf1b6dd6dd0495bda139daafd7a403ae2dc1
- https://git.kernel.org/stable/c/6d2390653d82cad0e1ba2676e536dd99678f6ef1
- https://git.kernel.org/stable/c/7dfa5a5516ec3c6b9b6c22ee18f0eb2df3f38ef2
- https://git.kernel.org/stable/c/b518e86d1a70a88f6592a7c396cf1b93493d1aab
- https://git.kernel.org/stable/c/eccc02ba1747501d92bb2049e3ce378ba372f641
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html