CVE-2025-38289

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk

Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error handling.

Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= e4913d4bc59227fbdfe6b8f5541f49aaea1cb41c, < ea405fb4144985d5c60f49c2abd9ba47ea44fdb4; >= 4281f44ea8bfedd25938a0031bebba1473ece9ad, < 4f09940b5581e44069eb31a66cf7f05c3c35ed04; >= 4281f44ea8bfedd25938a0031bebba1473ece9ad, < b5162bb6aa1ec04dff4509b025883524b6d7e7ca; >= 6.12.5, < 6.12.37
LinuxLinux6.13

References

Timeline

Published
Jul 10, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-38299.8A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been classified as critical. Affected is an unknown functionCVE-2025-382905.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix node corruption in ar->arvifs list In current WLAN rCVE-2025-382915.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Prevent sending WMI commands to firmware during firmware CVE-2025-382927.1In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid access to memory In ath12k_dp_rx_msdu_coalesCVE-2025-382935.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix node corruption in ar->arvifs list In current WLAN rCVE-2025-382945.5In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL access in assign channel context handler CurrenCVE-2025-382957.8In the Linux kernel, the following vulnerability has been resolved: perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() inCVE-2025-382965.5In the Linux kernel, the following vulnerability has been resolved: ACPI: platform_profile: Avoid initializing on non-ACPI platforms The pCVE-2025-382975.5In the Linux kernel, the following vulnerability has been resolved: PM: EM: Fix potential division-by-zero error in em_compute_costs() WheCVE-2025-382987.8In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault After loading i10nm_edacCVE-2025-382995.5In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() ETDM2_IN_BECVE-2025-38309.8A vulnerability was found in kuangstudy KuangSimpleBBS 1.0. It has been declared as critical. Affected by this vulnerability is the function
CVE-2025-38289: High severity, CVSS 7.8 | Vulnix