Use-After-Free Vulnerability in Linux Kernel's SCSI mvsas Package
Summary
DEBIAN-CVE-2025-40001: In the Linux kernel, the following vulnerability has been resolved: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_wor... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. The SCSI mvsas package is a driver for Marvell's SAS/SATA controllers, facilitating communication between the operating system and storage devices. This package is critical for ensuring data integrity and performance in systems utilizing Marvell hardware. However, it is susceptible to a use-after-free vulnerability, which can lead to serious security issues if not addressed promptly.
Vulnerability Detail
The vulnerability arises from a race condition during the detachment of Marvell's SAS/SATA controller. Specifically, the original code calls cancel_delayed_work() in the mvs_free() function to cancel a delayed work item. If this work item is already executing, the cancellation may fail, leading to a scenario where mvs_free() deallocates mvs_info while mvs_work_queue() is still accessing it. This can result in use-after-free errors, potentially allowing an attacker to exploit the freed memory, leading to system instability or unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can ensure that the delayed work items are not executing before calling mvs_free(). However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The use-after-free vulnerability in the Linux kernel's SCSI mvsas package poses a significant risk to systems utilizing Marvell's SAS/SATA controllers. It is crucial for users to update their Linux packages to the latest version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to unpredictable behavior or security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any installation.
Exploitation of this vulnerability could lead to system crashes, data corruption, or unauthorized access to sensitive information.
Yes, updating to the latest patched version of the Linux package will resolve this vulnerability. Always ensure you are using the most recent version.
If immediate updates are not possible, consider applying the temporary workaround by ensuring delayed work items are not executing before freeing memory.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
