Fixed
Created: Nov 12, 2025
Updated: Nov 25, 2025
Resolved Date: Nov 24, 2025
Found In Version: 10.25.33.1
Fix Version: 10.25.33.3
Severity: Standard
Applicable for: Wind River Linux LTS 25
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod[EOL][EOL]Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when[EOL]device is gone") UBSAN reports:[EOL][EOL] UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17[EOL] index 28 is out of range for type 'pm8001_phy [16]'[EOL][EOL]on rmmod when using an expander.[EOL][EOL]For a direct attached device, attached_phy contains the local phy id.[EOL]For a device behind an expander, attached_phy contains the remote phy[EOL]id, not the local phy id.[EOL][EOL]I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a[EOL]device behind an expander, attached_phy can be much larger than[EOL]pm8001_ha->chip->n_phy (depending on the amount of phys of the[EOL]expander).[EOL][EOL]E.g. on my system pm8001_ha has 8 phys with phy ids 0-7. One of the[EOL]ports has an expander connected. The expander has 31 phys with phy ids[EOL]0-30.[EOL][EOL]The pm8001_ha->phy array only contains the phys of the HBA. It does not[EOL]contain the phys of the expander. Thus, it is wrong to use attached_phy[EOL]to index the pm8001_ha->phy array for a device behind an expander.[EOL][EOL]Thus, we can only clear phy_attached for devices that are directly[EOL]attached.
