CVE-2025-71235 - Vulnerability Details

- scsi: qla2xxx: Delay module unload while fabric scan in progress

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Delay module unload while fabric scan in progress

System crash seen during load/unload test in a loop.

[105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086
[105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0
[105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000
[105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000
[105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0
[105954.384928] PKRU: 55555554
[105954.384929] Call Trace:
[105954.384931] <IRQ>
[105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx]
[105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx]
[105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx]
[105954.384999] ? __wake_up_common+0x80/0x190
[105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx]
[105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx]
[105954.385040] ? __handle_irq_event_percpu+0x3d/0x190
[105954.385044] ? handle_irq_event+0x58/0xb0
[105954.385046] ? handle_edge_irq+0x93/0x240
[105954.385050] ? __common_interrupt+0x41/0xa0
[105954.385055] ? common_interrupt+0x3e/0xa0
[105954.385060] ? asm_common_interrupt+0x22/0x40

The root cause of this was that there was a free (dma_free_attrs) in the
interrupt context. There was a device discovery/fabric scan in
progress. A module unload was issued which set the UNLOADING flag. As
part of the discovery, after receiving an interrupt a work queue was
scheduled (which involved a work to be queued). Since the UNLOADING
flag is set, the work item was not allocated and the mapped memory had
to be freed. The free occurred in interrupt context leading to system
crash. Delay the driver unload until the fabric scan is complete to
avoid the crash.

Published: 2026-02-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The qla2xxx SCSI driver in the Linux kernel crashes when the driver module is unloaded while a fabric scan is still running. The crash is caused by freeing DMA memory in interrupt context after a UNLOADING flag is set; the associated work item was not allocated, so the memory is freed prematurely, triggering a kernel panic. This results in a denial of service that requires a reboot to recover.

Affected Systems

Any Linux system that includes the qla2xxx driver in its kernel is potentially affected. The vulnerability applies to kernel versions where the driver is present before the fix; the exact versions are not specified in the available data.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% signals a low likelihood of exploitation at present. The vulnerability is not catalogued in the CISA KEV list. Based on the description, the likely attack vector is local: an attacker with sufficient privilege to unload the qla2xxx kernel module during an ongoing fabric scan can trigger the crash. No remote exploitation path is documented in the given information.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< d8af012f92eee021c6ebb7093e65813c926c336b
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 891f9969a29e9767a453cef4811c8d2472ccab49
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 984dc1a51bf6fc3ca4e726abe790ec38952935d8
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 528b2f1027edfb52af0171f0f4b227fb356dde05
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< c068ebbaf52820d6bdefb9b405a1e426663c635a
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 7062eb0c488f35730334daad9495d9265c574853
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 8890bf450e0b6b283f48ac619fca5ac2f14ddd62

Linux

affected

Version	Status	Constraints
`4.8`	affected	—
`0`	unaffected	< 4.8
`5.10.251`	unaffected	≤ 5.10.*
`5.15.201`	unaffected	≤ 5.15.*
`6.1.164`	unaffected	≤ 6.1.*
`6.6.125`	unaffected	≤ 6.6.*
`6.12.72`	unaffected	≤ 6.12.*
`6.18.11`	unaffected	≤ 6.18.*
`6.19.1`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,528b2f1027edfb52af0171f0f4b227fb356dde05)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c068ebbaf52820d6bdefb9b405a1e426663c635a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7062eb0c488f35730334daad9495d9265c574853)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.125,6.7.0)`	unaffected	semver	—
`[6.12.72,6.13.0)`	unaffected	semver	—
`[6.18.11,6.19.0)`	unaffected	semver	—
`[6.19.1,6.20.0)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that implements the corrected unload logic, delaying driver removal until fabric scan completion.
If an immediate kernel update is unavailable, block or defer qla2xxx module unload operations while a fabric scan is active, for example by enforcing a lock or by checking a status flag before calling module removal.
As a temporary measure, suspend or postpone fabric scans during periods when unloading may occur, ensuring that the driver is not instructed to unload during scan activity.

Generated by OpenCVE AI on April 20, 2026 at 20:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4498-1	linux security update
Debian DLA	DLA-4499-1	linux-6.1 security update
Debian DSA	DSA-6141-1	linux security update
Debian DSA	DSA-6163-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00031.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/528b2f1027edfb52af0171f0f4b227fb356dde05
https://git.kernel.org/stable/c/7062eb0c488f35730334daad9495d9265c574853
https://git.kernel.org/stable/c/8890bf450e0b6b283f48ac619fca5ac2f14ddd62
https://git.kernel.org/stable/c/891f9969a29e9767a453cef4811c8d2472ccab49
https://git.kernel.org/stable/c/984dc1a51bf6fc3ca4e726abe790ec38952935d8
https://git.kernel.org/stable/c/c068ebbaf52820d6bdefb9b405a1e426663c635a
https://git.kernel.org/stable/c/d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32
https://git.kernel.org/stable/c/d8af012f92eee021c6ebb7093e65813c926c336b
https://lore.kernel.org/linux-cve-announce/2026021805-CVE-2025-71235-b233@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-71235
https://www.cve.org/CVERecord?id=CVE-2025-71235

History

Wed, 18 Mar 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Mon, 23 Feb 2026 03:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/8890bf450e0b6b283f48ac619fca5ac2f14ddd62

Thu, 19 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/891f9969a29e9767a453cef4811c8d2472ccab49 https://git.kernel.org/stable/c/984dc1a51bf6fc3ca4e726abe790ec38952935d8 https://git.kernel.org/stable/c/d8af012f92eee021c6ebb7093e65813c926c336b

Thu, 19 Feb 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021805-CVE-2025-71235-b233@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-71235 https://www.cve.org/CVERecord?id=CVE-2025-71235
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 18 Feb 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Delay module unload while fabric scan in progress System crash seen during load/unload test in a loop. [105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 [105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0 [105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000 [105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000 [105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0 [105954.384928] PKRU: 55555554 [105954.384929] Call Trace: [105954.384931] <IRQ> [105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx] [105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx] [105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx] [105954.384999] ? __wake_up_common+0x80/0x190 [105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx] [105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx] [105954.385040] ? __handle_irq_event_percpu+0x3d/0x190 [105954.385044] ? handle_irq_event+0x58/0xb0 [105954.385046] ? handle_edge_irq+0x93/0x240 [105954.385050] ? __common_interrupt+0x41/0xa0 [105954.385055] ? common_interrupt+0x3e/0xa0 [105954.385060] ? asm_common_interrupt+0x22/0x40 The root cause of this was that there was a free (dma_free_attrs) in the interrupt context. There was a device discovery/fabric scan in progress. A module unload was issued which set the UNLOADING flag. As part of the discovery, after receiving an interrupt a work queue was scheduled (which involved a work to be queued). Since the UNLOADING flag is set, the work item was not allocated and the mapped memory had to be freed. The free occurred in interrupt context leading to system crash. Delay the driver unload until the fabric scan is complete to avoid the crash.
Title		scsi: qla2xxx: Delay module unload while fabric scan in progress
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/528b2f1027edfb52af0171f0f4b227fb356dde05 https://git.kernel.org/stable/c/7062eb0c488f35730334daad9495d9265c574853 https://git.kernel.org/stable/c/c068ebbaf52820d6bdefb9b405a1e426663c635a https://git.kernel.org/stable/c/d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-02-18T14:53:20.222Z

Updated: 2026-05-11T21:56:57.285Z

Reserved: 2026-02-18T14:25:13.845Z

Link: CVE-2025-71235

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-02-18T16:22:30.293

Modified: 2026-03-18T17:07:43.897

Link: CVE-2025-71235

Redhat

Severity : Low

Publid Date: 2026-02-18T00:00:00Z

Links: CVE-2025-71235 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-20T21:00:12Z

Weaknesses

NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object