CVE-2025-71235

scsi: qla2xxx: Delay module unload while fabric scan in progress

Published Feb 18, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Delay module unload while fabric scan in progress

System crash seen during load/unload test in a loop.

[105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086
[105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0
[105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000
[105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000
[105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0
[105954.384928] PKRU: 55555554
[105954.384929] Call Trace:
[105954.384931] <IRQ>
[105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx]
[105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx]
[105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx]
[105954.384999] ? __wake_up_common+0x80/0x190
[105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx]
[105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx]
[105954.385040] ? __handle_irq_event_percpu+0x3d/0x190
[105954.385044] ? handle_irq_event+0x58/0xb0
[105954.385046] ? handle_edge_irq+0x93/0x240
[105954.385050] ? __common_interrupt+0x41/0xa0
[105954.385055] ? common_interrupt+0x3e/0xa0
[105954.385060] ? asm_common_interrupt+0x22/0x40

The root cause of this was that there was a free (dma_free_attrs) in the
interrupt context. There was a device discovery/fabric scan in
progress. A module unload was issued which set the UNLOADING flag. As
part of the discovery, after receiving an interrupt a work queue was
scheduled (which involved a work to be queued). Since the UNLOADING
flag is set, the work item was not allocated and the mapped memory had
to be freed. The free occurred in interrupt context leading to system
crash. Delay the driver unload until the fabric scan is complete to
avoid the crash.

Analysis

Technical impact

The qla2xxx SCSI driver in the Linux kernel was found to crash when the module is unloaded while a fabric scan is still in progress. The crash occurs because DMA memory was freed in interrupt context after the driver had set an UNLOADING flag, leading to a kernel panic. This results in a denial of service that requires a system reboot to recover.

Affected Systems

Any Linux system that contains the qla2xxx driver within its kernel is potentially impacted. The vulnerability applies to kernel versions that include the driver before the fix; specific version ranges are not provided in the current data.

Risk and Exploitability

The CVSS score of 5.5 denotes moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in CISA's KEV catalog. An attacker with sufficient privilege to unload the qla2xxx kernel module while a fabric scan is running can trigger the crash, so the attack vector is local. There is no known remote exploitation path.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< d8af012f92eee021c6ebb7093e65813c926c336b
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 891f9969a29e9767a453cef4811c8d2472ccab49
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 984dc1a51bf6fc3ca4e726abe790ec38952935d8
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 528b2f1027edfb52af0171f0f4b227fb356dde05
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< c068ebbaf52820d6bdefb9b405a1e426663c635a
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 7062eb0c488f35730334daad9495d9265c574853
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 8890bf450e0b6b283f48ac619fca5ac2f14ddd62

Linux

affected

Version	Status	Constraints
`4.8`	affected	—
`0`	unaffected	< 4.8
`5.10.251`	unaffected	≤ 5.10.*
`5.15.201`	unaffected	≤ 5.15.*
`6.1.164`	unaffected	≤ 6.1.*
`6.6.125`	unaffected	≤ 6.6.*
`6.12.72`	unaffected	≤ 6.12.*
`6.18.11`	unaffected	≤ 6.18.*
`6.19.1`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,528b2f1027edfb52af0171f0f4b227fb356dde05)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c068ebbaf52820d6bdefb9b405a1e426663c635a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7062eb0c488f35730334daad9495d9265c574853)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6.6.125,6.7.0)`	unaffected	semver	—
`[6.12.72,6.13.0)`	unaffected	semver	—
`[6.18.11,6.19.0)`	unaffected	semver	—
`[6.19.1,6.20.0)`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the corrected unload logic, which delays unloading until the fabric scan completes.
If a patch is not immediately available, configure the system to block or defer qla2xxx module unload requests while a fabric scan is active, for example by checking a status flag before attempting module removal.
Alternatively, schedule fabric scans only during maintenance windows or when module unload is not expected, to prevent overlap with unload operations.

Generated by OpenCVE AI on October 19, 2026 at 21:05 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4498-1	linux security update
Debian DLA	DLA-4499-1	linux-6.1 security update
Debian DSA	DSA-6141-1	linux security update
Debian DSA	DSA-6163-1	linux security update
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.144% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/528b2f1027edfb52af0171f0f4b227fb356dde05
https://git.kernel.org/stable/c/7062eb0c488f35730334daad9495d9265c574853
https://git.kernel.org/stable/c/8890bf450e0b6b283f48ac619fca5ac2f14ddd62
https://git.kernel.org/stable/c/891f9969a29e9767a453cef4811c8d2472ccab49
https://git.kernel.org/stable/c/984dc1a51bf6fc3ca4e726abe790ec38952935d8
https://git.kernel.org/stable/c/c068ebbaf52820d6bdefb9b405a1e426663c635a
https://git.kernel.org/stable/c/d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32
https://git.kernel.org/stable/c/d8af012f92eee021c6ebb7093e65813c926c336b
https://lore.kernel.org/linux-cve-announce/2026021805-CVE-2025-71235-b233@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-71235
https://www.cve.org/CVERecord?id=CVE-2025-71235

History

Oct 19, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Jun 11, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 18, 2026 5:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Feb 23, 2026 3:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/8890bf450e0b6b283f48ac619fca5ac2f14ddd62

Feb 19, 2026 4:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/891f9969a29e9767a453cef4811c8d2472ccab49 https://git.kernel.org/stable/c/984dc1a51bf6fc3ca4e726abe790ec38952935d8 https://git.kernel.org/stable/c/d8af012f92eee021c6ebb7093e65813c926c336b

Feb 19, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021805-CVE-2025-71235-b233@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-71235 https://www.cve.org/CVERecord?id=CVE-2025-71235
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Feb 18, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Delay module unload while fabric scan in progress System crash seen during load/unload test in a loop. [105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 [105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0 [105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000 [105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000 [105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0 [105954.384928] PKRU: 55555554 [105954.384929] Call Trace: [105954.384931] <IRQ> [105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx] [105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx] [105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx] [105954.384999] ? __wake_up_common+0x80/0x190 [105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx] [105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx] [105954.385040] ? __handle_irq_event_percpu+0x3d/0x190 [105954.385044] ? handle_irq_event+0x58/0xb0 [105954.385046] ? handle_edge_irq+0x93/0x240 [105954.385050] ? __common_interrupt+0x41/0xa0 [105954.385055] ? common_interrupt+0x3e/0xa0 [105954.385060] ? asm_common_interrupt+0x22/0x40 The root cause of this was that there was a free (dma_free_attrs) in the interrupt context. There was a device discovery/fabric scan in progress. A module unload was issued which set the UNLOADING flag. As part of the discovery, after receiving an interrupt a work queue was scheduled (which involved a work to be queued). Since the UNLOADING flag is set, the work item was not allocated and the mapped memory had to be freed. The free occurred in interrupt context leading to system crash. Delay the driver unload until the fabric scan is complete to avoid the crash.
Title		scsi: qla2xxx: Delay module unload while fabric scan in progress
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/528b2f1027edfb52af0171f0f4b227fb356dde05 https://git.kernel.org/stable/c/7062eb0c488f35730334daad9495d9265c574853 https://git.kernel.org/stable/c/c068ebbaf52820d6bdefb9b405a1e426663c635a https://git.kernel.org/stable/c/d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32