scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports: UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]' on rmmod when using an expander. For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id. I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander). E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30. The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander. Thus, we can only clear phy_attached for devices that are directly attached.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.246, 5.15.195, 5.4.301, 6.1.156, 6.12.53, 6.17.3, 6.6.112
- CVEs
- CVE-2025-40118
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 11:31 UTC · Revision 1
Source evidence
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
core-osv · Original sourcePublished 12 Nov 2025, 10:23 UTC
In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports: UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]' on rmmod when using an expander. For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id. I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander). E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30. The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander. Thus, we can only clear phy_attached for devices that are directly attached.
osv:CVE-2025-40118
Kernel
Fixed versions: 5.4.301, 5.10.246, 5.15.195, 6.1.156, 6.6.112, 6.12.53, 6.17.3
Complete source record
{
"id": "12087c992525a5744b34846f4faeac3bd3684a2972b2cd3d6d8395a8ff1b65ed",
"url": "https://osv.dev/vulnerability/CVE-2025-40118",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod",
"summary": "In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 (\"scsi: pm80xx: Set phy_attached to zero when device is gone\") UBSAN reports: UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17 index 28 is out of range for type 'pm8001_phy [16]' on rmmod when using an expander. For a direct attached device, attached_phy contains the local phy id. For a device behind an expander, attached_phy contains the remote phy id, not the local phy id. I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a device behind an expander, attached_phy can be much larger than pm8001_ha->chip->n_phy (depending on the amount of phys of the expander). E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the ports has an expander connected. The expander has 31 phys with phy ids 0-30. The pm8001_ha->phy array only contains the phys of the HBA. It does not contain the phys of the expander. Thus, it is wrong to use attached_phy to index the pm8001_ha->phy array for a device behind an expander. Thus, we can only clear phy_attached for devices that are directly attached.",
"evidence": "osv:CVE-2025-40118",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.301",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.246",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.195",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.156",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.112",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.53",
"evidence": "/affected/1/ranges"
},
{
"value": "6.17.3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2025-40118",
"aliases": [
"CVE-2025-40118"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "05b512879eab41faa515b67fa3896d0005e97909"
},
{
"fixed": "d94be0a6ae9ade706d4270e740bdb4f79953a7fc"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "bc2140c8136200b4437e1abc0fb659968cb9baab"
},
{
"fixed": "45acbf154befedd9bc135f5e031fe7855d1e6493"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "1d8f9378cb4800c18e20d80ecd605b2b93e87a03"
},
{
"fixed": "eef5ef400893f8e3dbb09342583be0cdc716d566"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "30e482dfb8f27d22f518695d4bcb5e7f4c6cb08a"
},
{
"fixed": "9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a862d24e1fc3ab1b5e5f20878d2898cea346d0ec"
},
{
"fixed": "e62251954a128a2d0fcbc19e5fa39e08935bb628"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "0f9802f174227f553959422f844eeb9ba72467fe"
},
{
"fixed": "9326a1541e1b7ed3efdbab72061b82cf01c6477a"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "f7b705c238d1483f0a766e2b20010f176e5c0fb7"
},
{
"fixed": "83ced3c206c292458e47c7fac54223abc7141585"
},
{
"fixed": "251be2f6037fb7ab399f68cd7428ff274133d693"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.293"
},
{
"fixed": "5.4.301"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.237"
},
{
"fixed": "5.10.246"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.181"
},
{
"fixed": "5.15.195"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.136"
},
{
"fixed": "6.1.156"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.89"
},
{
"fixed": "6.6.112"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.12.26"
},
{
"fixed": "6.12.53"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.14.5"
},
{
"fixed": "6.15"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "722026c010fa75bcf9e2373aff1d7930a3d7e3cf"
}
]
}
],
"versions": [
"v5.4.300",
"v5.4.299",
"v5.4.298",
"v5.4.297",
"v5.4.296",
"v5.4.295",
"v5.4.294",
"v5.4.293",
"v5.10.245",
"v5.10.244",
"v5.10.243",
"v5.10.242",
"v5.10.241",
"v5.10.240",
"v5.10.239",
"v5.10.238",
"v5.10.237",
"v5.15.194",
"v5.15.193",
"v5.15.192",
"v5.15.191",
"v5.15.190",
"v5.15.189",
"v5.15.188",
"v5.15.187",
"v5.15.186",
"v5.15.185",
"v5.15.184",
"v5.15.183",
"v5.15.182",
"v5.15.181",
"v6.1.155",
"v6.1.154",
"v6.1.153",
"v6.1.152",
"v6.1.151",
"v6.1.150",
"v6.1.149",
"v6.1.148",
"v6.1.147",
"v6.1.146",
"v6.1.145",
"v6.1.144",
"v6.1.143",
"v6.1.142",
"v6.1.141",
"v6.1.140",
"v6.1.139",
"v6.1.138",
"v6.1.137",
"v6.1.136",
"v6.6.111",
"v6.6.110",
"v6.6.109",
"v6.6.108",
"v6.6.107",
"v6.6.106",
"v6.6.105",
"v6.6.104",
"v6.6.103",
"v6.6.102",
"v6.6.101",
"v6.6.100",
"v6.6.99",
"v6.6.98",
"v6.6.97",
"v6.6.96",
"v6.6.95",
"v6.6.94",
"v6.6.93",
"v6.6.92",
"v6.6.91",
"v6.6.90",
"v6.6.89",
"v6.12.52",
"v6.12.51",
"v6.12.50",
"v6.12.49",
"v6.12.48",
"v6.12.47",
"v6.12.46",
"v6.12.45",
"v6.12.44",
"v6.12.43",
"v6.12.42",
"v6.12.41",
"v6.12.40",
"v6.12.39",
"v6.12.38",
"v6.12.37",
"v6.12.36",
"v6.12.35",
"v6.12.34",
"v6.12.33",
"v6.12.32",
"v6.12.31",
"v6.12.30",
"v6.12.29",
"v6.12.28",
"v6.12.27",
"v6.12.26",
"v6.14.11",
"v6.14.10",
"v6.14.9",
"v6.14.8",
"v6.14.7",
"v6.14.6",
"v6.14.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40118.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.301"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.246"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.195"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.156"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.112"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.53"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.17.3"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40118.json"
}
}
],
"modified": "2026-10-28T02:30:28.106443687Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/251be2f6037fb7ab399f68cd7428ff274133d693",
"https://git.kernel.org/stable/c/45acbf154befedd9bc135f5e031fe7855d1e6493",
"https://git.kernel.org/stable/c/83ced3c206c292458e47c7fac54223abc7141585",
"https://git.kernel.org/stable/c/9326a1541e1b7ed3efdbab72061b82cf01c6477a",
"https://git.kernel.org/stable/c/9c671d4dbfbfb0d73cfdfb706afb36d9ad60a582",
"https://git.kernel.org/stable/c/d94be0a6ae9ade706d4270e740bdb4f79953a7fc",
"https://git.kernel.org/stable/c/e62251954a128a2d0fcbc19e5fa39e08935bb628",
"https://git.kernel.org/stable/c/eef5ef400893f8e3dbb09342583be0cdc716d566",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40118.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-40118",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40118.json"
}
},
"related_cves": [
{
"value": "CVE-2025-40118",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 494900,
"published_at": "2025-11-12T10:23:18.179+00:00"
}