CVE-2025-40001

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Marvell SAS/SATA controller within the Linux kernel where a use-after-free condition can occur during device detachment. Specifically, the cancel delayed work() function may fail to cancel a delayed work item if it is already running, leading to attempts to access freed memory within the mvs work queue() function after it has been deallocated by mvs free(). This issue arises from a race condition during the removal of the controller. The original code called cancel delayed work(), but replacing it with cancel delayed work sync() ensures proper cancellation and completion of the work item before memory deallocation. The issue was identified through static analysis.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.