{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"ea405fb4144985d5c60f49c2abd9ba47ea44fdb4","status":"affected","version":"e4913d4bc59227fbdfe6b8f5541f49aaea1cb41c","versionType":"git"},{"lessThan":"4f09940b5581e44069eb31a66cf7f05c3c35ed04","status":"affected","version":"4281f44ea8bfedd25938a0031bebba1473ece9ad","versionType":"git"},{"lessThan":"b5162bb6aa1ec04dff4509b025883524b6d7e7ca","status":"affected","version":"4281f44ea8bfedd25938a0031bebba1473ece9ad","versionType":"git"},{"lessThan":"6.12.37","status":"affected","version":"6.12.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.37","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2025-38289","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk\n\nSmatch detected a potential use-after-free of an ndlp oject in\ndev_loss_tmo_callbk during driver unload or fatal error handling.\n\nFix by reordering code to avoid potential use-after-free if initial\nnodelist reference has been previously removed.","epss":{"date":"2026-11-05","percentile":0.08736,"score":0.0019},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793912550937,"publishedAt":1752133325645,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/ea405fb4144985d5c60f49c2abd9ba47ea44fdb4"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/4f09940b5581e44069eb31a66cf7f05c3c35ed04"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b5162bb6aa1ec04dff4509b025883524b6d7e7ca"}],"remediation":[],"revision":"dbd5429ee4f33892011cac2682c2c5ede1b4aec805a0ffaeb0a8c45a980aab19","sources":[{"modifiedAt":1793912550937,"name":"CNA: Linux","retrievedAt":1793913640367,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38289"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913672465,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38289"}],"ssvc":{"assessedAt":1793911995446,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk","updatedAt":1793913672465}