CVE-2025-71235
Use-After-Free Vulnerability in Linux qla2xxx Driver Causes System Crash
Publication date: 2026-02-18
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.19 (inc) to 6.19.1 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.164 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.201 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.125 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.72 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.11 (exc) |
| linux | linux_kernel | From 4.8 (inc) to 5.10.251 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's qla2xxx SCSI driver. It occurs when the driver module is unloaded while a fabric scan (device discovery) is still in progress. During this process, an interrupt triggers a work queue to be scheduled. However, if the module unload has already set an UNLOADING flag, the work item is not allocated, and the memory that was mapped must be freed immediately in the interrupt context. Freeing memory in this context causes a system crash.
The root cause is that the driver attempts to free DMA memory during an interrupt, which is unsafe. The fix delays the module unload until the fabric scan completes, preventing the crash.
How can this vulnerability impact me? :
This vulnerability can cause your Linux system to crash unexpectedly during load and unload operations of the qla2xxx driver module, especially when a fabric scan is in progress. Such crashes can lead to system downtime, potential data loss, and disruption of services relying on the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a system crash during load/unload tests of the qla2xxx driver module, particularly when a fabric scan is in progress.
Detection can involve monitoring system logs for crash traces related to the qla2xxx driver. Look for kernel messages similar to the provided call trace involving qla24xx_sp_unmap and related functions.
Commands to help detect this issue include checking the kernel ring buffer for relevant errors:
- dmesg | grep qla2xxx
- journalctl -k | grep qla2xxx
- modinfo qla2xxx
Additionally, monitoring for repeated module load/unload cycles or fabric scans in progress may help identify the vulnerable state.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by unloading the qla2xxx driver module while a fabric scan is in progress, leading to a system crash.
Immediate mitigation steps include:
- Avoid unloading the qla2xxx kernel module while a fabric scan or device discovery is active.
- Delay the module unload until the fabric scan completes to prevent freeing memory in interrupt context.
- If possible, update the Linux kernel to a version where this issue is resolved.