CVE-2025-40001

In the Linux kernel, the following vulnerability has been resolved:

scsi: mvsas: Fix use-after-free bugs in mvs_work_queue

During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info.

A typical race condition is illustrated below:

CPU 0 (remove) | CPU 1 (delayed work callback) mvs_pci_remove() | mvs_free() | mvs_work_queue() cancel_delayed_work() | kfree(mvi) | | mvi-> // UAF

Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated.

This bug was found by static analysis.

The patch fixes a use-after-free in the Marvell mvsas driver during device detach: the driver used cancel_delayed_work() instead of the synchronous variant, so a running delayed work (mvs_work_queue) could continue after mvs_info had been freed. Impact is a reliable kernel crash/DoS (and theoretically harder-to-exploit memory corruption) when a device is removed while the work is pending. This can be reproduced by hot-unplug/PCI reset or module removal on systems using the mvsas HBA while its delayed work is active. For the CVSS the PR:H, because requires local access and a specific hardware/driver configuration, typically with admin-level ability to trigger device removal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.