CVE-2025-38289: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38289 Overview

CVE-2025-38289 is a use-after-free vulnerability in the Linux kernel's lpfc SCSI driver, which supports Emulex Fibre Channel Host Bus Adapters. Smatch static analysis detected the flaw in the dev_loss_tmo_callbk function during driver unload or fatal error handling. The issue occurs when the initial nodelist (ndlp) reference has already been removed, leaving code paths that still dereference the freed object. The vulnerability is tracked under CWE-416: Use After Free and affects local, low-privilege attackers on systems using the lpfc driver.

Critical Impact
A local attacker with low privileges can trigger memory corruption in the kernel, potentially leading to privilege escalation, kernel panic, or arbitrary code execution in ring 0.

Affected Products

Linux Kernel — scsi: lpfc driver (Emulex Fibre Channel HBA)
Distributions shipping vulnerable kernel versions prior to the stable patch commits
Server environments using Emulex Fibre Channel HBAs for SAN storage

Discovery Timeline

2025-07-10 - CVE-2025-38289 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38289

Vulnerability Analysis

The lpfc driver manages Fibre Channel remote ports and tracks their state using node list (ndlp) objects. When a remote port becomes unreachable, the SCSI transport layer invokes the dev_loss_tmo_callbk callback to release driver resources tied to that port. During driver unload or fatal error paths, the initial ndlp reference may already have been dropped by another cleanup routine.

The callback continues to access the ndlp object after the reference count has reached zero and the memory has been freed. This produces a classic use-after-free condition inside kernel context. Because the freed slab memory can be reallocated and populated by an attacker-influenced object, the flaw can be leveraged for controlled kernel memory corruption.

The fix reorders operations in dev_loss_tmo_callbk so the driver validates and holds a valid reference before dereferencing the node structure. The upstream fixes are recorded in kernel commits 4f09940, b5162bb, and ea405fb.

Root Cause

The root cause is improper lifetime management of the ndlp object. Code in dev_loss_tmo_callbk assumed the nodelist reference was still valid when reached during unload or fatal error handling. Because prior cleanup paths can drop that reference first, subsequent access reads from freed memory [CWE-416].

Attack Vector

Exploitation requires local access with low privileges on a system running the vulnerable lpfc driver. An attacker triggers driver unload or induces a fatal error condition on a Fibre Channel HBA to reach the vulnerable code path. Successful exploitation yields kernel memory corruption with high confidentiality, integrity, and availability impact.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability remains low, reflecting limited attractiveness for opportunistic exploitation compared to remotely reachable flaws.

Detection Methods for CVE-2025-38289

Indicators of Compromise

Unexpected kernel oops or panic messages referencing lpfc_dev_loss_tmo_callbk or lpfc_nlp_put in dmesg and /var/log/messages
KASAN or SLUB debug reports indicating use-after-free in the lpfc module
Repeated driver reload events (modprobe -r lpfc followed by modprobe lpfc) from unprivileged sessions
Fibre Channel port state flapping correlated with process activity from non-administrative users

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface use-after-free access in the lpfc code path before production rollout
Compare running kernel version against the patched stable commits and flag hosts still on vulnerable builds
Monitor kernel ring buffer for stack traces containing dev_loss_tmo_callbk during storage subsystem events
Alert on module unload operations targeting lpfc performed by non-root or unexpected user contexts

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into a centralized logging pipeline for anomaly analysis
Track kernel crash dumps via kdump and inspect backtraces for lpfc frames
Baseline Fibre Channel HBA link events and alert on abnormal frequency from a single host
Correlate audit logs (auditd) for init_module and delete_module syscalls against expected change windows

How to Mitigate CVE-2025-38289

Immediate Actions Required

Inventory all Linux hosts using the lpfc driver by running lsmod | grep lpfc and confirm kernel build versions
Apply the patched kernel package from your distribution vendor covering commits 4f09940, b5162bb, and ea405fb
Restrict CAP_SYS_MODULE and root shell access on servers with Fibre Channel HBAs to reduce local attack surface
Schedule a maintenance window to reboot into the patched kernel; live patching is not available for all distributions

Patch Information

The Linux kernel maintainers resolved the flaw by reordering the reference-count and dereference logic in dev_loss_tmo_callbk. Fixes are available in the stable tree via commits 4f09940b5581, b5162bb6aa1e, and ea405fb41449. Consume the fix through your distribution's kernel update channel (dnf update kernel, apt upgrade linux-image-*, or vendor-specific ELS/EUS streams).

Workarounds

If patching is not immediately possible, blacklist the lpfc module on hosts that do not require Fibre Channel connectivity by adding blacklist lpfc to /etc/modprobe.d/
Limit local access to servers with Emulex HBAs through strict SSH controls, sudoers policy, and PAM restrictions
Disable unprivileged module loading by setting kernel.modules_disabled=1 after boot on hardened systems
Enable Secure Boot with a signed kernel and lockdown mode to prevent unauthorized driver replacement

bash

# Verify kernel version and lpfc driver status
uname -r
modinfo lpfc | grep -E 'version|filename'

# Prevent unprivileged module operations after boot
echo 'kernel.modules_disabled = 1' >> /etc/sysctl.d/99-hardening.conf
sysctl -p /etc/sysctl.d/99-hardening.conf

# Blacklist lpfc on hosts that do not need Fibre Channel
cat <<EOF > /etc/modprobe.d/blacklist-lpfc.conf
blacklist lpfc
install lpfc /bin/true
EOF