CVE-2025-37861

Severity CVSS v4.0:
Pending analysis
Type:
CWE-416 Use After Free
Publication date:
09/05/2025
Last modified:
12/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue<br /> <br /> When the task management thread processes reply queues while the reset<br /> thread resets them, the task management thread accesses an invalid queue ID<br /> (0xFFFF), set by the reset thread, which points to unallocated memory,<br /> causing a crash.<br /> <br /> Add flag &amp;#39;io_admin_reset_sync&amp;#39; to synchronize access between the reset,<br /> I/O, and admin threads. Before a reset, the reset handler sets this flag to<br /> block I/O and admin processing threads. If any thread bypasses the initial<br /> check, the reset thread waits up to 10 seconds for processing to finish. If<br /> the wait exceeds 10 seconds, the controller is marked as unrecoverable.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.14 (including) 6.12.24 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.13.12 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.14 (including) 6.14.3 (excluding)