LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path

In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability. When a device removal is triggered (via hot-unplug or module unload), race condition can occur. The fix adds tasklet_kill() before freeing the asd_ha structure, ensuring all scheduled tasklets complete before cleanup proceeds.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel flaw in the aic94xx SCSI driver cleanup path. During hardware removal or module unload, delayed tasklet work may still reference memory after it is freed. The sources do not provide CVSS, confirmed impact, or active exploitation evidence.

Executive priority

Treat as a targeted infrastructure maintenance issue, not an emergency internet-wide exposure based on current evidence. Prioritize affected storage or industrial systems where kernel crashes or instability during device removal would affect operations.

Technical view

asd_pci_remove() can free the asd_ha structure without first synchronizing pending tasklets. A race during hot-unplug or module unload can create a use-after-free. The kernel fix adds tasklet_kill() before freeing asd_ha so scheduled tasklets finish before cleanup continues.

Likely exposure

Exposure appears limited to Linux systems with the aic94xx SCSI driver present and relevant hardware or module lifecycle activity. Kernel source data lists affected Linux versions and stable fix commits; product-specific exposure beyond the Siemens advisory reference is not detailed in the bundle.

Exploitation context

No KEV listing is present, and the provided sources do not claim active exploitation or public exploit availability. Trigger conditions described are local device removal, hot-unplug, or module unload race conditions, not remote network attack.

Researcher notes

The core issue is a teardown race in the aic94xx driver. The source bundle gives fix intent and stable commit references but lacks CVSS, detailed impact analysis, exploitability assessment, and Siemens product impact details.

Mitigation direction

  • Apply Linux stable kernel updates containing the aic94xx tasklet_kill cleanup fix.
  • Check Linux distribution and hardware vendor advisories for packaged kernel availability.
  • Prioritize systems using aic94xx-supported SCSI/SAS hardware or loading the aic94xx module.
  • Avoid nonessential hot-unplug or module unload operations on affected systems until remediated.

Validation and detection

  • Inventory systems for affected Linux kernel versions and aic94xx module presence.
  • Confirm whether vendor kernels include one of the referenced stable fix commits.
  • Review hardware inventories for aic94xx-supported controllers or dependent Siemens product guidance.
  • After patching, verify the running kernel is the remediated vendor build.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71075 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2908d778ab3e244900c310974e1fc1c69066e450, 2908d778ab3e244900c310974e1fc1c69066e450, 2908d778ab3e244900c310974e1fc1c69066e450, 2908d778ab3e244900c310974e1fc1c69066e450, 2908d778ab3e244900c310974e1fc1c69066e450, 2908d778ab3e244900c310974e1fc1c69066e450, 2908d778ab3e244900c310974e1fc1c69066e450unaffected
LinuxLinux2.6.19, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.