VDB

CVE-2025-38289

CVE-2025-38289 PUBLISHED

scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk

Reported by linux · Published July 10, 2025

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error handling. Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed.

EPSS 0.19% · 8.7th percentile

Risk scores

EPSS Score
0.19%
8.7th percentile

Affected products

VendorProductVersions
LinuxLinuxe4913d4bc59227fbdfe6b8f5541f49aaea1cb41c, 4281f44ea8bfedd25938a0031bebba1473ece9ad, 4281f44ea8bfedd25938a0031bebba1473ece9ad
LinuxLinux6.13, 0, 6.12.37
linuxlinux_kernel6.13, 6.12.5, 6.13
LinuxLinux*, 4281f44ea8bfedd25938a0031bebba1473ece9ad, 0

Timeline

  • Jul 9, 2025 CVE Published
  • Jul 10, 2025 EPSS Score (30 in total, the first dated here)
  • Oct 11, 2025 PoC Published (15 in total, the first dated here)
  • Mar 29, 2026 Distribution Patch (138 in total, the first dated here)
  • Mar 29, 2026 Security Advisory (144 in total, the first dated here)
  • Jun 9, 2026 Coalition ESS Score
  • Oct 7, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-38289
vulnetix vdb fixes CVE-2025-38289

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-38289/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›