In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error handling. Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2025071011-CVE-2025-38289-0d93@gregkh/T
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:1194 https://access.redhat.com/errata/RHSA-2026:1194
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:4111 https://access.redhat.com/errata/RHSA-2026:4111