CVE-2025-40115 in Linux
Sumário
de VulDB • 01/07/2026
Based on the kernel log snippet provided, here is an analysis of the crash and recommended troubleshooting steps.
### **1. Summary** * **Event:** Kernel Oops/Panic during module unload (`rmmod mpt3sas`). * **Driver:** `mpt3sas` (LSI/Broadcom SAS/HBA controller driver). * **Trigger:** The system is attempting to remove the PCI device/driver, which cascades into removing SCSI devices and expanders. A null pointer dereference or invalid memory access occurs during this cleanup process. * **Key Function in Trace:** `mpt3sas_transport_port_remove` → `_scsih_remove_device`.
### **2. Detailed Analysis of the Call Trace** The crash happens while tearing down the SAS topology: 1. `pci_unregister_driver`: The PCI subsystem is unloading the driver. 2. `_mpt3sas_exit`: Driver-specific exit routine. 3. `scsih_remove`: Removes SCSI devices associated with this HBA. 4. `_scsih_expander_node_remove`: Removing an expander node (SAS topology). 5. `mpt3sas_device_remove_by_sas_address`: Looking up a device by SAS address to remove it. 6. **`_scsih_remove_device`**: Attempting to clean up the SCSI device structure. 7. **`mpt3sas_transport_port_remove`**: This is where the crash likely originates or propagates from. It tries to access transport layer data for a port that may already be partially freed, corrupted, or in an inconsistent state. 8. `_dev_printk`: The kernel tried to print an error message but crashed again (or this was the final fault), indicating `dev` pointer might be NULL or invalid.
### **3. Common Causes** 1. **Race Condition:** A hardware event (link down, device removal) occurred while the driver was being unloaded (`rmmod`). The driver tried to access freed memory. 2. **Firmware Bug:** Older firmware on LSI/Broadcom HBAs has known issues with expander teardown sequences under Linux. 3. **Kernel Bug:** A regression in the `mpt3sas` driver code between kernel versions (common in kernels 5.x–6.x). 4. **Corrupted SAS Topology:** An expander or device was not properly enumerated, leading to dangling pointers during removal.
### **4. Recommended Solutions**
#### **A. Immediate Workaround: Avoid Unloading the Module** If this happens only when you manually unload the module (`rmmod mpt3sas`), consider that it’s often unnecessary unless debugging. The driver is designed to stay loaded until reboot or hotplug events. If you must reload, try: ```bash # Ensure no I/O is active on the HBA first echo 1 > /sys/class/scsi_host/hostX/scan # Optional: rescan if needed later
# Try unloading with a delay to let pending commands complete sleep 2 rmmod mpt3sas ```
#### **B. Update Firmware and Driver** 1. **Update HBA Firmware:** Check your LSI/Broadcom controller model (e.g., SAS3008, SAS4008) on Broadcom’s support site for the latest firmware. Many `mpt3sas` crashes are fixed by firmware updates that handle expander teardown better. 2. **Update Kernel:** If you’re using an older kernel (<5.15), upgrade to a newer LTS kernel (6.1, 6.6, or 6.8+). The `mpt3sas` driver has seen significant fixes for race conditions during device removal in recent years.
#### **C. Check dmesg for Preceding Errors** Look at logs *before* this Oops for: - `"SCSI error"` or `"I/O error"` on the HBA’s disks. - `"mpt3sas: %s: failed to send command"` messages. - Expander link failures (`"expander link down/up"`).
These indicate underlying hardware issues that destabilize the driver during unload.
#### **D. Disable Power Management (If Applicable)** Sometimes aggressive power management causes timing issues during teardown. Try adding these kernel parameters: ```bash pcie_aspm=off mpt3sas.no_hba_power_mgmt=1 ``` *(Note: `no_hba_power_mgmt` may not be a valid parameter for all versions; check `modinfo mpt3sas`.)*
#### **E. Patch/Backport Fix (Advanced)** If this is a known regression in your specific kernel version, search the Linux Kernel Mailing List (LKML) or Broadcom’s internal bug tracker for:
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.