CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In the Linux kernel, the following vulnerability has been resolved:
scsi: mvsas: Fix use-after-free bugs in mvsworkqueue
During the detaching of Marvell's SAS/SATA controller, the original code calls canceldelayedwork() in mvsfree() to cancel the delayed work item mwq->workq. However, if mwq->workq is already running, the canceldelayedwork() may fail to cancel it. This can lead to use-after-free scenarios where mvsfree() frees the mvsinfo while mvsworkqueue() is still executing and attempts to access the already-freed mvsinfo.
A typical race condition is illustrated below:
CPU 0 (remove) | CPU 1 (delayed work callback) mvspciremove() | mvsfree() | mvsworkqueue() canceldelayedwork() | kfree(mvi) | | mvi-> // UAF
Replace canceldelayedwork() with canceldelayedworksync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvsinfo is deallocated.
This bug was found by static analysis.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40001?
CVE-2025-40001 is classified as a medium severity vulnerability due to the potential for use-after-free exploits.
How do I fix CVE-2025-40001?
To fix CVE-2025-40001, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2025-40001?
CVE-2025-40001 affects the Linux kernel when using Marvell's SAS/SATA controller.
What type of vulnerability is CVE-2025-40001?
CVE-2025-40001 is a use-after-free vulnerability found in the SCSI subsystem of the Linux kernel.
Is CVE-2025-40001 actively exploited?
As of now, there are no confirmed reports of active exploitation of CVE-2025-40001.