1. Home
  2. Vulnerabilities
  3. CVE-2025-39676
0.0
NA
CVE-2025-39676
scsi: qla4xxx: Prevent a potential error pointer dereference
Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.

INFO

Published Date :

Sept. 5, 2025, 6:15 p.m.

Last Modified :

Sept. 5, 2025, 6:15 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2025-39676 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Solution
Update the Linux kernel to prevent error pointer dereferences in the qla4xxx driver.
  • Update the Linux kernel to the latest version.
  • Apply necessary patches for the qla4xxx driver.
  • Test the system after applying updates.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-39676.

URL Resource
https://git.kernel.org/stable/c/325bf7d57c4e2a341e381c5805e454fb69dd78c3
https://git.kernel.org/stable/c/46288d12d1c30d08fbeffd05abc079f57a43a2d4
https://git.kernel.org/stable/c/9dcf111dd3e7ed5fce82bb108e3a3fc001c07225
https://git.kernel.org/stable/c/ad8a9d38d30c691a77c456e72b78f7932d4f234d
https://git.kernel.org/stable/c/d0225f41ee70611ca88ccb22c8542ecdfa7faea8
https://git.kernel.org/stable/c/f1424c830d6ce840341aac33fe99c8ac45447ac1
https://git.kernel.org/stable/c/f4bc3cdfe95115191e24592bbfc15f1d4a705a75
https://git.kernel.org/stable/c/f5ad0819f902b4b33591791b92a0350fb3692a6b
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-39676 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-39676 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-39676 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-39676 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Sep. 05, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.
    Added Reference https://git.kernel.org/stable/c/325bf7d57c4e2a341e381c5805e454fb69dd78c3
    Added Reference https://git.kernel.org/stable/c/46288d12d1c30d08fbeffd05abc079f57a43a2d4
    Added Reference https://git.kernel.org/stable/c/9dcf111dd3e7ed5fce82bb108e3a3fc001c07225
    Added Reference https://git.kernel.org/stable/c/ad8a9d38d30c691a77c456e72b78f7932d4f234d
    Added Reference https://git.kernel.org/stable/c/d0225f41ee70611ca88ccb22c8542ecdfa7faea8
    Added Reference https://git.kernel.org/stable/c/f1424c830d6ce840341aac33fe99c8ac45447ac1
    Added Reference https://git.kernel.org/stable/c/f4bc3cdfe95115191e24592bbfc15f1d4a705a75
    Added Reference https://git.kernel.org/stable/c/f5ad0819f902b4b33591791b92a0350fb3692a6b
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.