Bug 2396944 (CVE-2025-39841)

Summary:	CVE-2025-39841 kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A use-after-free vulnerability exists in the linux kernel such that the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-09-19 16:03:20 UTC

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix buffer free/clear order in deferred receive path

Fix a use-after-free window by correcting the buffer release sequence in
the deferred receive path. The code freed the RQ buffer first and only
then cleared the context pointer under the lock. Concurrent paths (e.g.,
ABTS and the repost path) also inspect and release the same pointer under
the lock, so the old order could lead to double-free/UAF.

Note that the repost path already uses the correct pattern: detach the
pointer under the lock, then free it after dropping the lock. The
deferred path should do the same.

Comment 1 Jon Moroney 2025-09-19 16:24:05 UTC Comment hidden (spam)

This comment was flagged as spam, view the edit history to see the original text if required.

Comment 4 errata-xmlrpc 2025-10-20 02:00:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:18281 https://access.redhat.com/errata/RHSA-2025:18281

Comment 5 errata-xmlrpc 2025-10-20 09:49:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:18318 https://access.redhat.com/errata/RHSA-2025:18318

Comment 6 errata-xmlrpc 2025-10-27 09:35:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:19103 https://access.redhat.com/errata/RHSA-2025:19103

Comment 7 errata-xmlrpc 2025-10-27 09:38:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:19102 https://access.redhat.com/errata/RHSA-2025:19102

Comment 8 errata-xmlrpc 2025-11-12 05:14:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:21083 https://access.redhat.com/errata/RHSA-2025:21083

Comment 9 errata-xmlrpc 2025-11-12 05:16:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:21084 https://access.redhat.com/errata/RHSA-2025:21084

Comment 10 errata-xmlrpc 2025-11-12 11:25:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:21112 https://access.redhat.com/errata/RHSA-2025:21112

Comment 11 errata-xmlrpc 2025-11-12 12:22:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:21118 https://access.redhat.com/errata/RHSA-2025:21118

Comment 12 errata-xmlrpc 2025-12-03 12:44:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:22661 https://access.redhat.com/errata/RHSA-2025:22661

Comment 13 errata-xmlrpc 2025-12-10 00:22:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:22997 https://access.redhat.com/errata/RHSA-2025:22997

Comment 14 errata-xmlrpc 2025-12-10 00:25:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:22995 https://access.redhat.com/errata/RHSA-2025:22995

Comment 15 errata-xmlrpc 2025-12-10 00:49:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:22999 https://access.redhat.com/errata/RHSA-2025:22999

Comment 16 errata-xmlrpc 2025-12-10 00:53:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:22996 https://access.redhat.com/errata/RHSA-2025:22996

Comment 17 errata-xmlrpc 2025-12-17 07:47:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:23445 https://access.redhat.com/errata/RHSA-2025:23445

Comment 18 errata-xmlrpc 2025-12-17 15:00:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:23463 https://access.redhat.com/errata/RHSA-2025:23463