CVE-2025-40118

A flaw was found in the Linux kernel’s pm8001_sas driver (SCSI: pm80xx). When unloading (rmmod) a device behind an expander, the code uses attached_phy (which may refer to a remote phy id) to index into the pm8001_ha->phy array, but the array only has entries for local phys. This out-of-bounds indexing is reported by UBSAN, which may lead to undefined behavior.

A moderate severity flaw was found in the Linux kernel PM80xx SAS/SCSI driver (pm8001_sas). When the pm80xx driver module is unloaded (rmmod) on a system where a SAS device is connected through an expander, the driver used the attached_phy value - which for a device behind an expander holds the remote expander phy id - to index the pm8001_ha->phy array, which only contains entries for the HBA's local phys. Because an expander can have more phys than the HBA, this results in an out-of-bounds array access (reported by UBSAN) that may lead to undefined behavior in the kernel at module unload time. Triggering the issue requires local privileged access to unload the kernel module together with the specific hardware configuration of a SAS expander connected to the HBA. Red Hat assessed the impact as moderate (CVSS 3.1 score 5.8), lower than the CVE.org severity of 7.8 (Important), due to the high attack complexity, the local privileges required, and the limited confidentiality and integrity impact of this unload-time out-of-bounds access. No Red Hat product is currently affected: Red Hat Enterprise Linux 7 through 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 1.1 are marked not affected because the vulnerable code is not present in the shipped kernels, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.