PT-2025-35968 · Linux+6 · Linux Kernel+6
Published
2025-06-18
·
Updated
2026-04-20
·
CVE-2025-38695
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel’s SCSI subsystem, specifically within the lpfc (Low-Level Fibre Channel) driver. A null pointer dereference may occur during the cleanup of the
lpfc vport structure if lpfc sli4 read rev() fails during the lpfc sli4 hba setup() function. This can happen before the hardware queues (hdwq) are allocated, leading to a potential crash when attempting to access a null pointer within the abts io buf list lock for the first hardware queue. The issue is addressed by adding a null pointer check for phba->sli4 hba.hdwq and returning early if the check fails, indicating an error during port initialization.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu
Lpfc