CVE-2025-38289

A flaw was found in the Linux kernel's scsi: lpfc component. This vulnerability involves a use-after-free error in the dev_loss_tmo_callbk function. During driver unload or fatal error handling, a previously freed object could be accessed. This could allow a local attacker to cause a system crash, leading to a denial of service.

This vulnerability is rated as Moderate impact because it requires local access on systems equipped with Emulex LightPulse Fibre Channel hardware running the lpfc driver, and it is triggered only during specific error handling or module unloading sequences. Most enterprise environments that do not utilize Fibre Channel storage infrastructure or this specific adapter type remain unaffected. For systems with active adapters, the issue may lead to a denial of service through a kernel crash if device loss timeouts coincide with driver cleanup routines.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.