CVE-2025-40001

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: mvsas: Fix use-after-free bugs in mvs_work_queue

During the detaching of Marvell's SAS/SATA controller, the original code

calls cancel_delayed_work() in mvs_free() to cancel the delayed work

item mwq->work_q. However, if mwq->work_q is already running, the

cancel_delayed_work() may fail to cancel it. This can lead to

use-after-free scenarios where mvs_free() frees the mvs_info while

mvs_work_queue() is still executing and attempts to access the

already-freed mvs_info.

A typical race condition is illustrated below:

CPU 0 (remove) | CPU 1 (delayed work callback)

mvs_pci_remove() |

mvs_free() | mvs_work_queue()

cancel_delayed_work() |

kfree(mvi) |

| mvi-> // UAF

Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure

that the delayed work item is properly canceled and any executing

delayed work item completes befor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References