CVE-2025-40118 (GCVE-0-2025-40118)

Vulnerability from cvelistv5 – Published: 2025-11-12 10:23 – Updated: 2026-08-05 12:07
VLAI
Title
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports: UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]' on rmmod when using an expander. For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id. I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander). E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30. The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander. Thus, we can only clear phy_attached for devices that are directly attached.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6856 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 05b512879eab41faa515b67fa3896d0005e97909 , < d94be0a6ae9ade706d4270e740bdb4f79953a7fc (git)
Affected: bc2140c8136200b4437e1abc0fb659968cb9baab , < 45acbf154befedd9bc135f5e031fe7855d1e6493 (git)
Affected: 1d8f9378cb4800c18e20d80ecd605b2b93e87a03 , < eef5ef400893f8e3dbb09342583be0cdc716d566 (git)
Affected: 30e482dfb8f27d22f518695d4bcb5e7f4c6cb08a , < 9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582 (git)
Affected: a862d24e1fc3ab1b5e5f20878d2898cea346d0ec , < e62251954a128a2d0fcbc19e5fa39e08935bb628 (git)
Affected: 0f9802f174227f553959422f844eeb9ba72467fe , < 9326a1541e1b7ed3efdbab72061b82cf01c6477a (git)
Affected: f7b705c238d1483f0a766e2b20010f176e5c0fb7 , < 83ced3c206c292458e47c7fac54223abc7141585 (git)
Affected: f7b705c238d1483f0a766e2b20010f176e5c0fb7 , < 251be2f6037fb7ab399f68cd7428ff274133d693 (git)
Affected: 722026c010fa75bcf9e2373aff1d7930a3d7e3cf (git)
Affected: 5.4.293 , < 5.4.301 (semver)
Affected: 5.10.237 , < 5.10.246 (semver)
Affected: 5.15.181 , < 5.15.195 (semver)
Affected: 6.1.136 , < 6.1.156 (semver)
Affected: 6.6.89 , < 6.6.112 (semver)
Affected: 6.12.26 , < 6.12.53 (semver)
Affected: 6.14.5 , < 6.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 5.4.301 , ≤ 5.4.* (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 5.15.195 , ≤ 5.15.* (semver)
Unaffected: 6.1.156 , ≤ 6.1.* (semver)
Unaffected: 6.6.112 , ≤ 6.6.* (semver)
Unaffected: 6.12.53 , ≤ 6.12.* (semver)
Unaffected: 6.17.3 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/pm8001/pm8001_sas.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d94be0a6ae9ade706d4270e740bdb4f79953a7fc",
              "status": "affected",
              "version": "05b512879eab41faa515b67fa3896d0005e97909",
              "versionType": "git"
            },
            {
              "lessThan": "45acbf154befedd9bc135f5e031fe7855d1e6493",
              "status": "affected",
              "version": "bc2140c8136200b4437e1abc0fb659968cb9baab",
              "versionType": "git"
            },
            {
              "lessThan": "eef5ef400893f8e3dbb09342583be0cdc716d566",
              "status": "affected",
              "version": "1d8f9378cb4800c18e20d80ecd605b2b93e87a03",
              "versionType": "git"
            },
            {
              "lessThan": "9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582",
              "status": "affected",
              "version": "30e482dfb8f27d22f518695d4bcb5e7f4c6cb08a",
              "versionType": "git"
            },
            {
              "lessThan": "e62251954a128a2d0fcbc19e5fa39e08935bb628",
              "status": "affected",
              "version": "a862d24e1fc3ab1b5e5f20878d2898cea346d0ec",
              "versionType": "git"
            },
            {
              "lessThan": "9326a1541e1b7ed3efdbab72061b82cf01c6477a",
              "status": "affected",
              "version": "0f9802f174227f553959422f844eeb9ba72467fe",
              "versionType": "git"
            },
            {
              "lessThan": "83ced3c206c292458e47c7fac54223abc7141585",
              "status": "affected",
              "version": "f7b705c238d1483f0a766e2b20010f176e5c0fb7",
              "versionType": "git"
            },
            {
              "lessThan": "251be2f6037fb7ab399f68cd7428ff274133d693",
              "status": "affected",
              "version": "f7b705c238d1483f0a766e2b20010f176e5c0fb7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "722026c010fa75bcf9e2373aff1d7930a3d7e3cf",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.301",
              "status": "affected",
              "version": "5.4.293",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.246",
              "status": "affected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.195",
              "status": "affected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.156",
              "status": "affected",
              "version": "6.1.136",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.112",
              "status": "affected",
              "version": "6.6.89",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.53",
              "status": "affected",
              "version": "6.12.26",
              "versionType": "semver"
            },
            {
              "lessThan": "6.15",
              "status": "affected",
              "version": "6.14.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/pm8001/pm8001_sas.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "5.4.293",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "5.10.237",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "versionStartIncluding": "5.15.181",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.156",
                  "versionStartIncluding": "6.1.136",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "6.6.89",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.12.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.14.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod\n\nSince commit f7b705c238d1 (\"scsi: pm80xx: Set phy_attached to zero when\ndevice is gone\") UBSAN reports:\n\n  UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17\n  index 28 is out of range for type \u0027pm8001_phy [16]\u0027\n\non rmmod when using an expander.\n\nFor a direct attached device, attached_phy contains the local phy id.\nFor a device behind an expander, attached_phy contains the remote phy\nid, not the local phy id.\n\nI.e. while pm8001_ha will have pm8001_ha-\u003echip-\u003en_phy local phys, for a\ndevice behind an expander, attached_phy can be much larger than\npm8001_ha-\u003echip-\u003en_phy (depending on the amount of phys of the\nexpander).\n\nE.g. on my system pm8001_ha has 8 phys with phy ids 0-7.  One of the\nports has an expander connected.  The expander has 31 phys with phy ids\n0-30.\n\nThe pm8001_ha-\u003ephy array only contains the phys of the HBA.  It does not\ncontain the phys of the expander.  Thus, it is wrong to use attached_phy\nto index the pm8001_ha-\u003ephy array for a device behind an expander.\n\nThus, we can only clear phy_attached for devices that are directly\nattached."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds write is reached through local host operations on the pm80xx SAS HBA \u2014 system suspend (`pm8001_pci_suspend` \u2192 `sas_suspend_ha` \u2192 `sas_suspend_devices`), driver unbind/rmmod, or sysfs device delete \u2014 none of which cross a network boundary. A physical variant exists (hot-unplugging a drive on an expander phy \u2265 16), but the local suspend path is both reachable and more severe.\nAC:L - Once a SAS device is enumerated behind an expander with more than 16 phys \u2014 the standard 24/28/36-phy JBOD backplane configuration described in the commit \u2014 every suspend or removal event deterministically performs the OOB write, with no race to win and no unpredictable state required. The offending index is a stable property of the cabled topology, which the attacker can repeatedly re-trigger.\nPR:L - An unprivileged user with an active local session can invoke system suspend through the default logind/polkit policy, and `sas_suspend_devices()` calls `lldd_dev_gone` for every device on `port-\u003edev_list`, including expander children, driving the OOB write without any capability. No CAP_SYS_MODULE or root is needed on this path.\nUI:N - The attacker triggers suspend or device teardown directly; no separate victim needs to open a file, mount a filesystem, or take any action.\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - A controllable-offset out-of-bounds write into and beyond a large kmalloc\u0027d `pm8001_hba_info` object corrupts adjacent slab objects \u2014 zeroing a length, index, or pointer byte in a neighbouring structure is a standard route to over-read and kernel memory disclosure. Per kernel scoring guidance, memory corruption leveragable for info disclosure is High.\nI:H - This is a direct out-of-bounds write (`phy[idx].phy_attached = 0` with idx up to 127 into a 16-element array), landing in `asd_sas_port` list heads/spinlocks/pointers, the `devices`/`ccb_info` pointers, and ultimately in unrelated heap objects \u2014 a cross-object write primitive with attacker-influenced offset.\nA:H - The bug is confirmed by UBSAN as an array-index-out-of-bounds, and zeroing bytes of live `list_head`s, spinlocks, and kernel pointers reliably produces oopses, corrupted list traversal, or panic on the next use of the clobbered structure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:55.038Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d94be0a6ae9ade706d4270e740bdb4f79953a7fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/45acbf154befedd9bc135f5e031fe7855d1e6493"
        },
        {
          "url": "https://git.kernel.org/stable/c/eef5ef400893f8e3dbb09342583be0cdc716d566"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582"
        },
        {
          "url": "https://git.kernel.org/stable/c/e62251954a128a2d0fcbc19e5fa39e08935bb628"
        },
        {
          "url": "https://git.kernel.org/stable/c/9326a1541e1b7ed3efdbab72061b82cf01c6477a"
        },
        {
          "url": "https://git.kernel.org/stable/c/83ced3c206c292458e47c7fac54223abc7141585"
        },
        {
          "url": "https://git.kernel.org/stable/c/251be2f6037fb7ab399f68cd7428ff274133d693"
        }
      ],
      "title": "scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40118",
    "datePublished": "2025-11-12T10:23:18.179Z",
    "dateReserved": "2025-04-16T07:20:57.168Z",
    "dateUpdated": "2026-08-05T12:07:55.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40118",
      "date": "2026-10-21",
      "epss": "0.00164",
      "percentile": "0.05364"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/pm8001/pm8001_sas.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d94be0a6ae9ade706d4270e740bdb4f79953a7fc",
                    "status": "affected",
                    "version": "05b512879eab41faa515b67fa3896d0005e97909",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "45acbf154befedd9bc135f5e031fe7855d1e6493",
                    "status": "affected",
                    "version": "bc2140c8136200b4437e1abc0fb659968cb9baab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eef5ef400893f8e3dbb09342583be0cdc716d566",
                    "status": "affected",
                    "version": "1d8f9378cb4800c18e20d80ecd605b2b93e87a03",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582",
                    "status": "affected",
                    "version": "30e482dfb8f27d22f518695d4bcb5e7f4c6cb08a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e62251954a128a2d0fcbc19e5fa39e08935bb628",
                    "status": "affected",
                    "version": "a862d24e1fc3ab1b5e5f20878d2898cea346d0ec",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9326a1541e1b7ed3efdbab72061b82cf01c6477a",
                    "status": "affected",
                    "version": "0f9802f174227f553959422f844eeb9ba72467fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "83ced3c206c292458e47c7fac54223abc7141585",
                    "status": "affected",
                    "version": "f7b705c238d1483f0a766e2b20010f176e5c0fb7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "251be2f6037fb7ab399f68cd7428ff274133d693",
                    "status": "affected",
                    "version": "f7b705c238d1483f0a766e2b20010f176e5c0fb7",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "722026c010fa75bcf9e2373aff1d7930a3d7e3cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.4.301",
                    "status": "affected",
                    "version": "5.4.293",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.10.246",
                    "status": "affected",
                    "version": "5.10.237",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.195",
                    "status": "affected",
                    "version": "5.15.181",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.156",
                    "status": "affected",
                    "version": "6.1.136",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.112",
                    "status": "affected",
                    "version": "6.6.89",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.53",
                    "status": "affected",
                    "version": "6.12.26",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "affected",
                    "version": "6.14.5",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/pm8001/pm8001_sas.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.301",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.246",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.195",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.156",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod\n\nSince commit f7b705c238d1 (\"scsi: pm80xx: Set phy_attached to zero when\ndevice is gone\") UBSAN reports:\n\n  UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17\n  index 28 is out of range for type \u0027pm8001_phy [16]\u0027\n\non rmmod when using an expander.\n\nFor a direct attached device, attached_phy contains the local phy id.\nFor a device behind an expander, attached_phy contains the remote phy\nid, not the local phy id.\n\nI.e. while pm8001_ha will have pm8001_ha-\u003echip-\u003en_phy local phys, for a\ndevice behind an expander, attached_phy can be much larger than\npm8001_ha-\u003echip-\u003en_phy (depending on the amount of phys of the\nexpander).\n\nE.g. on my system pm8001_ha has 8 phys with phy ids 0-7.  One of the\nports has an expander connected.  The expander has 31 phys with phy ids\n0-30.\n\nThe pm8001_ha-\u003ephy array only contains the phys of the HBA.  It does not\ncontain the phys of the expander.  Thus, it is wrong to use attached_phy\nto index the pm8001_ha-\u003ephy array for a device behind an expander.\n\nThus, we can only clear phy_attached for devices that are directly\nattached."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: pm80xx: Correcci\u00f3n de \u00edndice de array fuera de l\u00edmites en rmmod\n\nDesde el commit f7b705c238d1 (\u201cscsi: pm80xx: Establecer phy_attached a cero cuando el dispositivo desaparece\u201d) UBSAN informa:\n\n  UBSAN: \u00edndice de array fuera de l\u00edmites en drivers/scsi/pm8001/pm8001_sas.c:786:17\n  el \u00edndice 28 est\u00e1 fuera de rango para el tipo \u0027pm8001_phy [16]\u0027\n\nen rmmod cuando se utiliza un expansor.\n\nPara un dispositivo conectado directamente, attached_phy contiene el ID de phy local.\nPara un dispositivo detr\u00e1s de un expansor, attached_phy contiene el ID de phy remoto, no el ID de phy local.\n\nEs decir, mientras que pm8001_ha tendr\u00e1 pm8001_ha-\u003echip-\u003en_phy phys locales, para un dispositivo detr\u00e1s de un expansor, attached_phy puede ser mucho mayor que pm8001_ha-\u003echip-\u003en_phy (dependiendo de la cantidad de phys del expansor).\n\nPor ejemplo, en mi sistema pm8001_ha tiene 8 phys con IDs de phy 0-7. Uno de los puertos tiene un expansor conectado. El expansor tiene 31 phys con IDs de phy 0-30.\n\nEl array pm8001_ha-\u003ephy solo contiene los phys del HBA. No contiene los phys del expansor. Por lo tanto, es incorrecto usar attached_phy para indexar el array pm8001_ha-\u003ephy para un dispositivo detr\u00e1s de un expansor.\n\nPor lo tanto, solo podemos borrar phy_attached para dispositivos que est\u00e1n conectados directamente."
          }
        ],
        "id": "CVE-2025-40118",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-11-12T11:15:41.117",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/251be2f6037fb7ab399f68cd7428ff274133d693"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/45acbf154befedd9bc135f5e031fe7855d1e6493"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/83ced3c206c292458e47c7fac54223abc7141585"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9326a1541e1b7ed3efdbab72061b82cf01c6477a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d94be0a6ae9ade706d4270e740bdb4f79953a7fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e62251954a128a2d0fcbc19e5fa39e08935bb628"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eef5ef400893f8e3dbb09342583be0cdc716d566"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-16T23:16:38+00:00",
      "cve": "CVE-2025-40118",
      "id": "CVE-2025-40118",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "261",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40118.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.