LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue

In the Linux kernel, the following vulnerability has been resolved: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed work item mwq->work_q. However, if mwq->work_q is already running, the cancel_delayed_work() may fail to cancel it. This can lead to use-after-free scenarios where mvs_free() frees the mvs_info while mvs_work_queue() is still executing and attempts to access the already-freed mvs_info. A typical race condition is illustrated below: CPU 0 (remove) | CPU 1 (delayed work callback) mvs_pci_remove() | mvs_free() | mvs_work_queue() cancel_delayed_work() | kfree(mvi) | | mvi-> // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled and any executing delayed work item completes before the mvs_info is deallocated. This bug was found by static analysis.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-40001 is a Linux kernel bug in the Marvell SAS/SATA storage controller driver. During device removal, background work may keep running after related memory is freed, creating a use-after-free condition. The source reports a code fix but gives no CVSS score or confirmed exploitation.

Executive priority

Handle through normal kernel patch governance, with priority for storage servers using Marvell SAS/SATA hardware. The business risk is credible kernel memory corruption, but urgency is tempered by no provided CVSS score, no KEV entry, and no cited exploitation.

Technical view

The mvsas driver used cancel_delayed_work() during mvs_free(). If mvs_work_queue() was already executing, cancellation could fail and later access freed mvs_info memory. The kernel fix changes this to cancel_delayed_work_sync(), waiting for any running delayed work before deallocation.

Likely exposure

Exposure appears limited to Linux systems using the Marvell SAS/SATA mvsas driver on affected kernel lines. Systems without that controller or driver are unlikely to be exposed. Distribution kernel status must be confirmed through the relevant vendor because the bundle lists upstream stable commits, not distro package versions.

Exploitation context

The bundle says the bug was found by static analysis. It does not cite public exploitation, exploit availability, CISA KEV listing, or attacker prerequisites. Treat active exploitation as unconfirmed.

Researcher notes

The vulnerable pattern is a workqueue lifetime race during controller detach. Focus validation on whether the mvsas driver is present, loaded, and fixed in the running kernel. The source bundle does not establish reachability from remote attackers.

Mitigation direction

  • Apply distribution or vendor kernel updates that include the referenced stable fixes.
  • Prioritize Linux hosts using Marvell SAS/SATA controllers or the mvsas driver.
  • Plan reboot or kernel activation steps required by your platform.
  • If updates are unavailable, monitor vendor guidance for backports or mitigations.

Validation and detection

  • Inventory systems for Marvell SAS/SATA controllers and mvsas driver usage.
  • Confirm running kernel versions against vendor advisory or fixed package metadata.
  • Verify the deployed kernel includes the relevant upstream stable commit.
  • After patching, confirm the updated kernel is running, not only installed.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40001 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux20b09c2992fefbe78f8cede7b404fb143a413c52, 20b09c2992fefbe78f8cede7b404fb143a413c52, 20b09c2992fefbe78f8cede7b404fb143a413c52, 20b09c2992fefbe78f8cede7b404fb143a413c52, 20b09c2992fefbe78f8cede7b404fb143a413c52, 20b09c2992fefbe78f8cede7b404fb143a413c52, 20b09c2992fefbe78f8cede7b404fb143a413c52, 20b09c2992fefbe78f8cede7b404fb143a413c52unaffected
LinuxLinux2.6.31, 0, 5.4.301, 5.10.246, 5.15.195, 6.1.157, 6.6.113, 6.12.54, 6.17.4, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.