CVE-2025-39676

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla4xxx: Prevent a potential error pointer dereference

The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error,
but qla4xxx_ep_connect() returns error pointers.  Propagating the error
pointers will lead to an Oops in the caller, so change the error pointers
to NULL.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
LinuxCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
VendorProductVersion
linuxlinux_kernel
3.2.1 ≤
𝑥
< 5.4.297
linuxlinux_kernel
5.5 ≤
𝑥
< 5.10.241
linuxlinux_kernel
5.11 ≤
𝑥
< 5.15.190
linuxlinux_kernel
5.16 ≤
𝑥
< 6.1.149
linuxlinux_kernel
6.2 ≤
𝑥
< 6.6.103
linuxlinux_kernel
6.7 ≤
𝑥
< 6.12.44
linuxlinux_kernel
6.13 ≤
𝑥
< 6.16.4
linuxlinux_kernel
3.2
linuxlinux_kernel
3.2:rc7
linuxlinux_kernel
6.17:rc1
linuxlinux_kernel
6.17:rc2
debiandebian_linux
11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
vulnerable
bullseye (security)
5.10.247-1
fixed
bookworm
6.1.159-1
fixed
bookworm (security)
6.1.158-1
fixed
trixie
6.12.63-1
fixed
trixie (security)
6.12.48-1
fixed
forky
6.17.13-1
fixed
sid
6.18.5-1
fixed
linux-6.1
bullseye (security)
6.1.159-1~deb11u1
fixed