CVE-2025-39676
Medium
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Kernel
PublishedSep 5, 2025
First seenSep 5, 2025
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- linux linux_kernel5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.44, 6.16.4 or later
Patches
- git.kernel.org/stable/c/325bf7d57c4e2a341e381c5805e454fb69dd78c3
- git.kernel.org/stable/c/46288d12d1c30d08fbeffd05abc079f57a43a2d4
- git.kernel.org/stable/c/9dcf111dd3e7ed5fce82bb108e3a3fc001c07225
- git.kernel.org/stable/c/ad8a9d38d30c691a77c456e72b78f7932d4f234d
- git.kernel.org/stable/c/d0225f41ee70611ca88ccb22c8542ecdfa7faea8
- git.kernel.org/stable/c/f1424c830d6ce840341aac33fe99c8ac45447ac1
- git.kernel.org/stable/c/f4bc3cdfe95115191e24592bbfc15f1d4a705a75
- git.kernel.org/stable/c/f5ad0819f902b4b33591791b92a0350fb3692a6b
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.2.1 ≤ v < 5.4.297, 5.5 ≤ v < 5.10.241, 5.11 ≤ v < 5.15.190, 5.16 ≤ v < 6.1.149, 6.2 ≤ v < 6.6.103, 6.7 ≤ v < 6.12.44, 6.13 ≤ v < 6.16.4, 3.2, 6.17 | 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.44, 6.16.4 |
| debian debian_linux | 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.