CVE-2025-38695

A flaw was found in the Linux kernel lpfc driver, used for Fibre Channel storage adapters. During port initialization, the driver's cleanup routine can dereference a null pointer when hardware queue structures have not been allocated. A local user could trigger this condition and cause a kernel crash, leading to a denial of service until it is restarted.

In the linux kernel lpfc driver for Fibre Channel adapters, a null-pointer dereference can occur during error handling in port initialization. If lpfc_sli4_read_rev() fails before hardware queues are allocated, the cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() attempts to access the first queue lock and crshes, resulting in a denial of service until the driver is restarted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the lpfc kernel module from being loaded. Please see https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module to prevent it from loading automatically.