CVE-2025-37861
Severity CVSS v4.0:
Pending analysis
Type:
CWE-416
Use After Free
Publication date:
09/05/2025
Last modified:
12/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue<br />
<br />
When the task management thread processes reply queues while the reset<br />
thread resets them, the task management thread accesses an invalid queue ID<br />
(0xFFFF), set by the reset thread, which points to unallocated memory,<br />
causing a crash.<br />
<br />
Add flag &#39;io_admin_reset_sync&#39; to synchronize access between the reset,<br />
I/O, and admin threads. Before a reset, the reset handler sets this flag to<br />
block I/O and admin processing threads. If any thread bypasses the initial<br />
check, the reset thread waits up to 10 seconds for processing to finish. If<br />
the wait exceeds 10 seconds, the controller is marked as unrecoverable.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.14 (including) | 6.12.24 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.13.12 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.14 (including) | 6.14.3 (excluding) |
To consult the complete list of CPE names with products and versions, see this page



