---
id: CVE-2025-71075
title: 'scsi: aic94xx: fix use-after-free in device removal path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: aic94xx: fix use-after-free in device removal path

  The asd_pci_remove() function fails to synchronize with pending tasklets
  before freeing the asd_ha structure, …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 <
    c8f6f88cd1df35155258285c4f43268b361819df
  - >-
    Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 <
    278455a82245a572aeb218a6212a416a98e418de
  - >-
    Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 <
    b3e655e52b98a1d3df41c8e42035711e083099f8
  - >-
    Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 <
    e354793a7ab9bb0934ea699a9d57bcd1b48fc27b
  - >-
    Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 <
    a41dc180b6e1229ae49ca290ae14d82101c148c3
  - >-
    Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 <
    751c19635c2bfaaf2836a533caa3663633066dcf
  - >-
    Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 <
    f6ab594672d4cba08540919a4e6be2e202b60007
  - Linux 2.6.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-10T20:41:46.291525Z'
published: '2026-01-13'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T08:43:41.884Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71075'
references:
  - url: 'https://git.kernel.org/stable/c/c8f6f88cd1df35155258285c4f43268b361819df'
  - url: 'https://git.kernel.org/stable/c/278455a82245a572aeb218a6212a416a98e418de'
  - url: 'https://git.kernel.org/stable/c/b3e655e52b98a1d3df41c8e42035711e083099f8'
  - url: 'https://git.kernel.org/stable/c/e354793a7ab9bb0934ea699a9d57bcd1b48fc27b'
  - url: 'https://git.kernel.org/stable/c/a41dc180b6e1229ae49ca290ae14d82101c148c3'
  - url: 'https://git.kernel.org/stable/c/751c19635c2bfaaf2836a533caa3663633066dcf'
  - url: 'https://git.kernel.org/stable/c/f6ab594672d4cba08540919a4e6be2e202b60007'
tags:
  - cve.org
epss: 0.00147
epssPercentile: 0.04308
ingestedAt: '2026-09-08T15:33:26.995Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: aic94xx: fix use-after-free in device removal path

The asd_pci_remove() function fails to synchronize with pending tasklets
before freeing the asd_ha structure, leading to a potential
use-after-free vulnerability.

When a device removal is triggered (via hot-unplug or module unload),
race condition can occur.

The fix adds tasklet_kill() before freeing the asd_ha structure,
ensuring all scheduled tasklets complete before cleanup proceeds.

## Affected

- `Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 < c8f6f88cd1df35155258285c4f43268b361819df`
- `Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 < 278455a82245a572aeb218a6212a416a98e418de`
- `Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 < b3e655e52b98a1d3df41c8e42035711e083099f8`
- `Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 < e354793a7ab9bb0934ea699a9d57bcd1b48fc27b`
- `Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 < a41dc180b6e1229ae49ca290ae14d82101c148c3`
- `Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 < 751c19635c2bfaaf2836a533caa3663633066dcf`
- `Linux >= 2908d778ab3e244900c310974e1fc1c69066e450 < f6ab594672d4cba08540919a4e6be2e202b60007`
- `Linux 2.6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.