« Volver al listado

CVE-2025-40001

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

scsi: mvsas: Fix use-after-free bugs in mvs_work_queue

During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.

A typical race condition is illustrated below:

Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.

Leer descripción completaMostrar menos

This bug was found by static analysis.

Detalles técnicos trazas, registros y código del informe original
CPU 0 (remove)            | CPU 1 (delayed work callback)
mvs_pci_remove()          |
  mvs_free()              | mvs_work_queue()
    cancel_delayed_work() |
      kfree(mvi)          |
                          |   mvi-> // UAF

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-40001",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "20b09c2992fefbe78f8cede7b404fb143a413c52",
              "lessThan": "a6f68f219d4d4b92d7c781708d4afc4cc42961ec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "20b09c2992fefbe78f8cede7b404fb143a413c52",
              "lessThan": "aacd1777d4a795c387a20b9ca776e2c1225d05d7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "20b09c2992fefbe78f8cede7b404fb143a413c52",
              "lessThan": "6ba7e73cafd155a5d3abf560d315f0bab2b9d89f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "20b09c2992fefbe78f8cede7b404fb143a413c52",
              "lessThan": "c2c35cb2a31844f84f21ab364b38b4309d756d42",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "20b09c2992fefbe78f8cede7b404fb143a413c52",
              "lessThan": "3c90f583d679c81a5a607a6ae0051251b6dee35b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "20b09c2992fefbe78f8cede7b404fb143a413c52",
              "lessThan": "00d3af40b158ebf7c7db2b3bbb1598a54bf28127",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "20b09c2992fefbe78f8cede7b404fb143a413c52",
              "lessThan": "feb946d2fc9dc754bf3d594d42cd228860ff8647",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "20b09c2992fefbe78f8cede7b404fb143a413c52",
              "lessThan": "60cd16a3b7439ccb699d0bf533799eeb894fd217",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/scsi/mvsas/mv_init.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.31",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/scsi/mvsas/mv_init.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-10-18T08:15:34.130",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/00d3af40b158ebf7c7db2b3bbb1598a54bf28127",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c90f583d679c81a5a607a6ae0051251b6dee35b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/60cd16a3b7439ccb699d0bf533799eeb894fd217",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6ba7e73cafd155a5d3abf560d315f0bab2b9d89f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a6f68f219d4d4b92d7c781708d4afc4cc42961ec",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/aacd1777d4a795c387a20b9ca776e2c1225d05d7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c2c35cb2a31844f84f21ab364b38b4309d756d42",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/feb946d2fc9dc754bf3d594d42cd228860ff8647",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mvsas: Fix use-after-free bugs in mvs_work_queue\n\nDuring the detaching of Marvell's SAS/SATA controller, the original code\ncalls cancel_delayed_work() in mvs_free() to cancel the delayed work\nitem mwq->work_q. However, if mwq->work_q is already running, the\ncancel_delayed_work() may fail to cancel it. This can lead to\nuse-after-free scenarios where mvs_free() frees the mvs_info while\nmvs_work_queue() is still executing and attempts to access the\nalready-freed mvs_info.\n\nA typical race condition is illustrated below:\n\nCPU 0 (remove)            | CPU 1 (delayed work callback)\nmvs_pci_remove()          |\n  mvs_free()              | mvs_work_queue()\n    cancel_delayed_work() |\n      kfree(mvi)          |\n                          |   mvi-> // UAF\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the delayed work item is properly canceled and any executing\ndelayed work item completes before the mvs_info is deallocated.\n\nThis bug was found by static analysis."
    }
  ],
  "lastModified": "2026-06-17T09:21:05.997",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}