CVE-2025-40115 in Linux
Resumen
por VulDB • 2026-05-19
This is a Linux kernel oops/panic trace related to the **`mpt3sas` driver** (LSI/Broadcom SAS/HBA controller driver).
### Key Observations: 1. **Trigger**: The crash occurs during module removal (`delete_module`), specifically when the PCI driver is being unregistered (`pci_unregister_driver` → `_mpt3sas_exit`). 2. **Crash Location**: The fault happens in `_dev_printk` (called from `mpt3sas_transport_port_remove`), which suggests a **NULL pointer dereference** or invalid memory access when trying to print a device-related message. 3. **Context**: The driver is cleaning up devices and expanders (`_scsih_remove_device`, `_scsih_expander_node_remove`) during shutdown. 4. **CR2**: `00007f242b4db238` — This is the faulting address. It’s a user-space-like address (high bit set), which is unusual for kernel NULL derefs (which are typically `0x0` or `0x8`). This may indicate: - A use-after-free or dangling pointer. - Corruption of a device structure. - Possibly a bug in how the driver handles cleanup order.
### Likely Cause: - **Race condition or use-after-free** during driver unload: The driver may be accessing a device structure that has already been freed or is in an inconsistent state. - **Improper cleanup order**: `mpt3sas_transport_port_remove` is called while some internal state is already torn down. - **Known bug**: This pattern has been seen in older versions of the `mpt3sas` driver. Check if your kernel version is affected.
### Recommended Actions:
#### 1. **Update Kernel/Driver** - Check if your kernel version is recent enough. This issue may have been fixed in newer kernels. - If using a custom or older kernel, consider upgrading.
#### 2. **Check for Known Bugs** - Search for `mpt3sas oops during remove` or `mpt3sas NULL pointer deref` on: - [kernel.org bugzilla](https://bugzilla.kernel.org/)
- [Linux SCSI mailing list](https://lore.kernel.org/linux-scsi/)
- Example fix: Commit `mpt3sas: Fix use-after-free in transport port remove` (if exists in your kernel version).
#### 3. **Workaround: Avoid Unloading the Module** - If this happens during reboot/shutdown, it may be harmless (the system is already shutting down). - If it happens during runtime (e.g., `rmmod mpt3sas`), avoid unloading the module unless necessary.
#### 4. **Debugging Steps** - Enable kernel debugging: ```bash echo 1 > /sys/module/mpt3sas/parameters/debug_level ``` - Check `dmesg` for earlier warnings about device removal. - Use `kdump` to analyze the full crash dump if available.
#### 5. **Hardware Check** - Ensure your SAS/HBA firmware is up to date. - Check for hardware errors in `dmesg` (e.g., link resets, timeouts).
### Example Fix (if applicable): If this is a known issue, a patch might look like: ```c // In mpt3sas_transport_port_remove() if (!port || !port->dev) {
dev_warn(&ioc->pdev->dev, "port or device already removed\n"); return; } ```
### Conclusion: This is a **driver bug** in `mpt3sas` during cleanup. Update your kernel or apply a patch if available. If the crash only occurs during shutdown, it may be safe to ignore.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.