Linux kernel pm80xx: out-of-bounds phy array index when unloading the driver behind a SAS expander

Impact

For devices reached through a SAS expander, attached_phy holds the expander's remote phy id, which can be far larger than the number of phys on the HBA itself, yet the driver used it to index the fixed 16-entry pm8001_ha->phy array when clearing phy_attached. The reporter saw index 28 used on an 8-phy HBA with a 31-phy expander, which is an out-of-bounds access in kernel memory during driver teardown. This touches real datacenter storage - PMC/Microsemi SAS HBAs fronting JBODs on storage and head nodes, including the shared filesystem servers a GPU fleet depends on. Exposure is narrow: the path is reached on module unload or device teardown, which is root-only, so the realistic outcome is a corrupted-memory crash on a storage node rather than a tenant-reachable escalation.

Who can reach it

Local and root-privileged: unloading the pm80xx module (or equivalent device teardown) on a host with a pm80xx HBA and a SAS expander attached. Not reachable from a tenant workload and not reachable over the network.

What to do

Update to a stable kernel containing the fix that clears phy_attached only for directly attached devices (commits in the record). Until then, avoid rmmod of pm80xx on affected storage nodes - the condition is not hit during normal operation. The fix is a kernel upgrade, so each affected storage or head node needs a maintenance reboot; schedule it with the normal kernel cadence.

References

Related entries

• Linux kernel BPF: tailcalls ignore expected_attach_type, yielding NULL deref and bypassed context checksCVE-2025-40123 · Linux kernel BPF tailcall map compatibility (__bpf_prog_map_compatible)High
• Linux kernel SMC: dst entry can be freed under smc_clc_prfx_set during connect(), a local UAFCVE-2025-40139 · Linux kernel SMC protocol (smc_clc_prfx_set destination cache use-after-free)High
• Linux kernel (net/tls): The kTLS device-offload setup resolved the socket's netdevice outside RCU, so the net_device itCVE-2025-40149 · Linux kernel (net/tls)High
• Linux kernel BPF verifier: signed comparison accepts negative ALU instruction offsetsCVE-2025-40169 · Linux kernel BPF verifier (check_alu_op offset validation)High
• Linux kernel x86/mm: missing SMP barrier in switch_mm lets a context switch skip a required TLB flushCVE-2025-40174 · Linux kernel x86/mm switch_mm_irqs_off() (missing barrier between loaded_mm store and tlb_gen load)High
• Linux kernel crypto: skcipher request size left uninitialized, causing memory corruption and crashesCVE-2025-40182 · Linux kernel crypto skcipher (request size set from cra_reqsize)High