Use-After-Free Vulnerability in Marvell SAS/SATA Controller - Linux Kernel

CVE-2025-40001

What is CVE-2025-40001?

A vulnerability in the Linux kernel allows for a use-after-free condition within the Marvell SAS/SATA controller's code. Specifically, during the detachment process of this controller, if asynchronous work is not properly canceled, the system may continue operating on freed memory. This situation can lead to undefined behavior, which may be exploited by attackers to execute arbitrary code or crash the system. To mitigate this issue, the code has been updated to ensure that delayed work items are reliably canceled before the memory they rely on is deallocated, effectively safeguarding the integrity of the system during device removal.

News Articles

wiz.io

CVE-2025-40001

CVE-2025-40001 Impact, Exploitability, and Mitigation Steps | Wiz

Understand the critical aspects of CVE-2025-40001 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

References