CVE-2025-38695

What it actually does

Null pointer dereference when lpfc_sli4_vport_delete_fcp_xri_aborted attempts to acquire abts_io_buf_list_lock on an unallocated hdwq after lpfc_sli4_read_rev fails during port initialization.

Why it matters to the business

Local denial of service via kernel panic on systems using the lpfc driver; high prevalence of Linux kernel deployments increases exposure for organizations relying on Emulex/Broadcom Fibre Channel adapters.

How an attack unfolds

An attacker with local access triggers or waits for an lpfc_sli4_read_rev failure during HBA setup, causing the cleanup path to execute before sli4_hba.hdwqs allocation and dereference a null pointer; listed actors such as VMSCAPE and Container-Optimized OS privilege-escalation campaigns illustrate similar kernel memory corruption patterns that could be adapted.

How to fix it

Update the Linux kernel to commit 6711ce7e9de4eb1a541ef30638df1294ea4267f8 or later stable release containing the null-pointer check; reboot after upgrade and verify lpfc initialization completes without early failures.

How to confirm the fix worked

Confirm presence of the null check on phba->sli4_hba.hdwq inside lpfc_sli4_vport_delete_fcp_xri_aborted; run lpfc driver initialization under simulated read_rev failure conditions and verify no panic occurs.

Typical attack path

1. Obtain local user or container access on a Linux host with lpfc driver loaded
2. Force or induce failure in lpfc_sli4_read_rev during lpfc_sli4_hba_setup
3. Trigger vport deletion or FCP XRI abort cleanup before hardware queues are allocated
4. Crash the kernel via null dereference on phba->sli4_hba.hdwq

How to detect it

Search kernel logs for oops or panic messages referencing lpfc_sli4_vport_delete_fcp_xri_aborted, hdwq, or abts_io_buf_list_lock; examine dmesg and /var/log/kern.log around lpfc initialization or port reset events; correlate with threat actor patterns seen in VMSCAPE and Container-Optimized OS kernel exploits.

What your security team should do

• Apply the fixed kernel commit 6711ce7e9de4eb1a541ef30638df1294ea4267f8 immediately on all systems using lpfc adapters
• Prioritize patching hosts with direct Fibre Channel connectivity or high uptime requirements
• Monitor for kernel oops involving lpfc_vport or hdwq structures
• Review downstream dependent packages and rebuild any custom kernels incorporating lpfc