Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit… (CVE-2025-40118)
In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports: UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]' on rmmod when using an expander. For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id. I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander). E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30. The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander. Thus, we can only clear phy_attached for devices that are directly attached.
AI Analysis
Technical Summary
The Linux kernel's pm80xx SCSI driver contained a vulnerability where the phy_attached array was indexed using a remote phy ID for devices behind an expander. Since the pm8001_ha->phy array only contains local phys, using the remote phy ID as an index caused out-of-bounds access, as reported by UBSAN. This occurs during module removal (rmmod) when an expander is present. The fix ensures phy_attached is only cleared for directly attached devices, preventing invalid memory access.
Potential Impact
The vulnerability allows out-of-bounds array access in kernel memory, which can lead to memory corruption. According to the CVSS vector, the impact includes high confidentiality, integrity, and availability loss. This could potentially be exploited by a local attacker with low privileges to cause denial of service or escalate privileges by corrupting kernel memory.
Mitigation Recommendations
A fix has been implemented in the Linux kernel source to correct the array indexing logic in the pm80xx driver. Users should update to a kernel version that includes the commit f7b705c238d1 or later, which addresses this issue. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit… (CVE-2025-40118)
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports: UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]' on rmmod when using an expander. For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id. I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander). E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30. The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander. Thus, we can only clear phy_attached for devices that are directly attached.
CVSS v3.1
Score 7.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's pm80xx SCSI driver contained a vulnerability where the phy_attached array was indexed using a remote phy ID for devices behind an expander. Since the pm8001_ha->phy array only contains local phys, using the remote phy ID as an index caused out-of-bounds access, as reported by UBSAN. This occurs during module removal (rmmod) when an expander is present. The fix ensures phy_attached is only cleared for directly attached devices, preventing invalid memory access.
Potential Impact
The vulnerability allows out-of-bounds array access in kernel memory, which can lead to memory corruption. According to the CVSS vector, the impact includes high confidentiality, integrity, and availability loss. This could potentially be exploited by a local attacker with low privileges to cause denial of service or escalate privileges by corrupting kernel memory.
Mitigation Recommendations
A fix has been implemented in the Linux kernel source to correct the array indexing logic in the pm80xx driver. Users should update to a kernel version that includes the commit f7b705c238d1 or later, which addresses this issue. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fwp3-pc57-cmgf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40118"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d69c2644c7f847a8e3
Added to database: 07/30/2026, 15:50:46 UTC
Last enriched: 07/30/2026, 16:43:19 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.