Linux kernel lpfc: use-after-free in the deferred receive path on Emulex Fibre Channel HBAs

Impact

The lpfc driver freed an RQ buffer before clearing the context pointer under lock, so concurrent paths (ABTS handling, the repost path) could inspect and free the same pointer - a double-free or use-after-free in kernel context. On a GPU node this matters where Fibre Channel HBAs front shared storage for datasets and checkpoints: corruption here crashes the node or is a path to kernel memory corruption, and the trigger is fabric traffic timing rather than a local syscall, so it can fire without any tenant doing anything. Nodes without Emulex/Broadcom FC adapters do not load lpfc and are unaffected. NVD scores it local (AV:L), and no public exploit is described in the record.

Who can reach it

No tenant-facing attack path is described. Reachable only on hosts with an Emulex/Broadcom Fibre Channel HBA, through a race between the deferred receive path and ABTS/repost handling during fabric activity.

What to do

Take the stable kernel fix (five backports linked in the record) and reboot each affected node; the fix is in the lpfc driver, so it cannot be applied without replacing the running kernel. Fleets that use NVMe/TCP or Ethernet storage and have no FC HBAs can defer. The record names no single fixed release - check the stable branch you track against the linked commits.

References

Related entries

• Linux kernel ice: NULL dereference in the E810 low-latency PTP timestamp interrupt during resetCVE-2025-39854 · Linux kernel ice driver (Intel E810 PTP low-latency Tx timestamp interrupt)High
• Linux kernel ice: NULL dereference in the E810 PTP Tx timestamp IRQ racing driver resetCVE-2025-39855 · Linux kernel ice driver (Intel E810 PTP Tx timestamp IRQ, ice_ptp_ts_irq)High
• Linux kernel idxd: double free in idxd_setup_wqs() error path during DSA device probeCVE-2025-39870 · Linux kernel idxd driver (Intel Data Streaming Accelerator / DSA work-queue setup)High
• Linux kernel idxd: refcount underflow and use-after-free when unloading the Intel DSA driverCVE-2025-39871 · Linux kernel idxd driver (Intel DSA, device refcount on module removal)High
• Linux kernel DAMON sysfs: use-after-free reading kdamond state while a context is torn downCVE-2025-39877 · Linux kernel DAMON sysfs interface (state_show, /sys/kernel/mm/damon)High
• Linux kernel libceph: messenger reads and writes the v1 union member while msgr2 is in use, corrupting connection stateCVE-2025-39880 · Linux kernel libceph messenger (con->v1 union accessed while msgr2 is active)High