CVE-2025-38289

What it actually does

Potential use-after-free of an ndlp object in dev_loss_tmo_callbk during driver unload or fatal error handling in the lpfc SCSI driver.

Why it matters to the business

May cause kernel instability, crashes, or privilege escalation on Linux systems using Emulex Fibre Channel adapters, disrupting storage connectivity; widespread Linux kernel prevalence amplifies operational risk across servers and cloud environments.

How an attack unfolds

An attacker triggers driver unload or fatal error conditions to reach the flawed dev_loss_tmo_callbk path where an ndlp reference has already been freed, enabling use-after-free for denial of service or code execution; context from Linux kernel privilege escalation campaigns by threat actors increases likelihood of targeted attempts.

How to fix it

Update Linux kernel to fixed versions including 6.12.37, 6.1.56-r0 for Alpaquita 23, 6.6.58-r0 for Alpaquita stream, or commit ea405fb4144985d5c60f49c2abd9ba47ea44fdb4; apply vendor-specific backports immediately given ecosystem prevalence.

How to confirm the fix worked

Verify running kernel version against listed fixed releases; inspect lpfc driver source for reordered ndlp reference handling in dev_loss_tmo_callbk; confirm via git log or package manager that ea405fb4144985d5c60f49c2abd9ba47ea44fdb4 or equivalent is present.

Typical attack path

1. Obtain local access or ability to induce lpfc driver unload/fatal error
2. Trigger dev_loss_tmo_callbk with ndlp already dereferenced
3. Exploit freed ndlp object for memory corruption or control flow hijack
4. Escalate to kernel privileges or cause system crash

How to detect it

Review kernel logs and dmesg for lpfc ndlp use-after-free warnings or oops during unload/error paths; correlate with process activity around driver unload events and check for signs of exploitation seen in other Linux kernel privilege escalation attempts.

What your security team should do

• Apply kernel updates to fixed versions within 48 hours due to Linux kernel exploit activity
• Audit systems for lpfc driver usage and schedule reboots
• Monitor EPSS trend and related privilege escalation reports for increased urgency
• Test updates in staging environments matching production kernel configurations