Linux kernel lpfc: use-after-free of the nodelist object during driver unload or fatal error handling

Impact

Static analysis found that dev_loss_tmo_callbk() could touch an ndlp (nodelist) object after its initial reference had already been dropped, during driver unload or fatal-error handling. A use-after-free in the FC transport callback path means a kernel crash, and potentially corruption of whatever reused the freed object, at exactly the moment the node is already in trouble - an HBA reset, a fabric event, or a module unload. For a GPU fleet this matters where Fibre Channel HBAs carry the shared dataset or checkpoint volumes: the failure mode is the whole node going down mid-job, and the node has to be drained and rebooted to take the fix. The record gives no evidence of a tenant-reachable trigger; reaching it needs the driver teardown or an error path, not a crafted request from a pod.

Who can reach it

Local and privileged in practice: the path is entered on lpfc module unload, HBA fatal-error handling, or a device-loss timeout on the fabric. Unprivileged tenants in a GPU pod have no direct route to it. An attacker with root on the host, or an unstable FC fabric, can plausibly induce the teardown path repeatedly.

What to do

Update to a stable kernel carrying the reordering fix and reboot the node - the code is in a loadable module, so in principle an lpfc module reload would suffice, but unloading lpfc takes the FC storage paths down and is itself the buggy path, so schedule a drain and reboot instead. The record links only the upstream commits; no vendor advisory names a single fixed release.

References

Related entries

• Linux kernel (posix-cpu-timers): TOCTOU race between handle_posix_cpu_timers() and posix_cpu_timer_del()CVE-2025-38352 · Linux kernel (posix-cpu-timers)High
• Linux kernel idxd: container with /dev mounted can panic the host when the parent process diesCVE-2025-38369 · Linux kernel dmaengine idxd (Intel DSA work-queue teardown with /dev mounted into a container)High
• Linux kernel virtio-net: unchecked received length in xdp_linearize_page allows an out-of-bounds readCVE-2025-38375 · Linux kernel virtio-net (xdp_linearize_page received-length check)High
• Linux i915 GPU kernel driver (GT timeline / VMA allocation): A timeline is left held when VMA allocation fails, soCVE-2025-38389 · Linux i915 GPU kernel driver (GT timeline / VMA allocation)High
• Linux kernel SMC (struct smc_sock type confusion with inet_sock): Struct smc_sock does not embed struct inet_sock asCVE-2025-38475 · Linux kernel SMC (struct smc_sock type confusion with inet_sock)High
• Linux kernel (net/xfrm): The guard that forbids changing a collect_md xfrm interface never fired, so a changelink putsCVE-2025-38500 · Linux kernel (net/xfrm)High