CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla4xxx: Prevent a potential error pointer dereference
The qla4xxxgetepfwdb() function is supposed to return NULL on error, but qla4xxxepconnect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39676?
CVE-2025-39676 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-39676?
To address CVE-2025-39676, you should upgrade to the latest version of the affected kernel, specifically versions 6.6.96.2-2 or later for the azl3 kernel.
What software is affected by CVE-2025-39676?
CVE-2025-39676 affects the Microsoft azl3 kernel 6.6.96.2-1 and 6.6.96.2-2.
What is the impact of CVE-2025-39676 on systems?
The impact of CVE-2025-39676 can lead to potential error pointer dereferences, which may cause system instability.
When was CVE-2025-39676 resolved?
CVE-2025-39676 was resolved in the recent updates to the Linux kernel.