CVE-2025-71075 — scsi: aic94xx: fix use-after-free in device removal path

Back Back to CVE browser

HIGH

scsi: aic94xx: fix use-after-free in device removal path

Published Jan 13, 2026

7.8

HIGH

CVSS 3.1

EPSS 0.15%

Description

The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability.

When a device removal is triggered (via hot-unplug or module unload), race condition can occur.

The fix adds tasklet_kill() before freeing the asd_ha structure, ensuring all scheduled tasklets complete before cleanup proceeds.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  2.6.19
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <2.6.19
- Version
  5.10.248
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.198
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  6.1.160
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.12.64
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.3
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  6.19
  Status
  unaffected
  Constraints
  <=*
- Version
  6.6.120
  Status
  unaffected
  Constraints
  <=6.6.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
2.6.19	affected	-
0	unaffected	<2.6.19
5.10.248	unaffected	<=5.10.*
5.15.198	unaffected	<=5.15.*
6.1.160	unaffected	<=6.1.*
6.12.64	unaffected	<=6.12.*
6.18.3	unaffected	<=6.18.*
6.19	unaffected	<=*
6.6.120	unaffected	<=6.6.*

Red Hat Enterprise Linux 10

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

Red Hat statement

This can be triggered during PCI hot-unplug or module unload of the aic94xx driver. Systems with Adaptec AIC-94xx SAS controllers are affected. The fix adds tasklet_kill() to ensure proper synchronization before cleanup.

Metrics

0.15% 0.00147

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00147

Score over time

Jan–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.15% (0.00147)	3.32th	v5 (v2026.06.15)
Jun 15, 2026	0.13% (0.00126)	2.56th	v5 (v2026.06.15)
Jan 14, 2026	0.02% (0.00018)	3.87th	v4 (v2025.03.14)

Weaknesses (2)

CWE-364

CWE-416

Use After Free

References (13)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-71075		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2429045		Issue Tracking
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://git.kernel.org/stable/c/278455a82245a572aeb218a6212a416a98e418de		Patch
https://git.kernel.org/stable/c/751c19635c2bfaaf2836a533caa3663633066dcf		Patch
https://git.kernel.org/stable/c/a41dc180b6e1229ae49ca290ae14d82101c148c3		Patch
https://git.kernel.org/stable/c/b3e655e52b98a1d3df41c8e42035711e083099f8		Patch
https://git.kernel.org/stable/c/c8f6f88cd1df35155258285c4f43268b361819df		Patch
https://git.kernel.org/stable/c/e354793a7ab9bb0934ea699a9d57bcd1b48fc27b		Patch
https://git.kernel.org/stable/c/f6ab594672d4cba08540919a4e6be2e202b60007		Patch
https://lore.kernel.org/linux-cve-announce/2026011326-CVE-2025-71075-c85d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-71075
https://www.cve.org/CVERecord?id=CVE-2025-71075