CVE-2025-71235 - Vulnerability Details

- scsi: qla2xxx: Delay module unload while fabric scan in progress

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Delay module unload while fabric scan in progress

System crash seen during load/unload test in a loop.

[105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086
[105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0
[105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000
[105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000
[105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0
[105954.384928] PKRU: 55555554
[105954.384929] Call Trace:
[105954.384931] <IRQ>
[105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx]
[105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx]
[105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx]
[105954.384999] ? __wake_up_common+0x80/0x190
[105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx]
[105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx]
[105954.385040] ? __handle_irq_event_percpu+0x3d/0x190
[105954.385044] ? handle_irq_event+0x58/0xb0
[105954.385046] ? handle_edge_irq+0x93/0x240
[105954.385050] ? __common_interrupt+0x41/0xa0
[105954.385055] ? common_interrupt+0x3e/0xa0
[105954.385060] ? asm_common_interrupt+0x22/0x40

The root cause of this was that there was a free (dma_free_attrs) in the
interrupt context. There was a device discovery/fabric scan in
progress. A module unload was issued which set the UNLOADING flag. As
part of the discovery, after receiving an interrupt a work queue was
scheduled (which involved a work to be queued). Since the UNLOADING
flag is set, the work item was not allocated and the mapped memory had
to be freed. The free occurred in interrupt context leading to system
crash. Delay the driver unload until the fabric scan is complete to
avoid the crash.

Published: 2026-02-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The qla2xxx SCSI driver in the Linux kernel was found to crash when the module is unloaded while a fabric scan is still in progress. The crash occurs because DMA memory was freed in interrupt context after the driver had set an UNLOADING flag, leading to a kernel panic. This results in a denial of service that requires a system reboot to recover.

Affected Systems

Any Linux system that contains the qla2xxx driver within its kernel is potentially impacted. The vulnerability applies to kernel versions that include the driver before the fix; specific version ranges are not provided in the current data.

Risk and Exploitability

The CVSS score of 5.5 denotes moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in CISA's KEV catalog. An attacker with sufficient privilege to unload the qla2xxx kernel module while a fabric scan is running can trigger the crash, so the attack vector is local. There is no known remote exploitation path.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< d8af012f92eee021c6ebb7093e65813c926c336b
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 891f9969a29e9767a453cef4811c8d2472ccab49
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 984dc1a51bf6fc3ca4e726abe790ec38952935d8
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 528b2f1027edfb52af0171f0f4b227fb356dde05
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< c068ebbaf52820d6bdefb9b405a1e426663c635a
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 7062eb0c488f35730334daad9495d9265c574853
`783e0dc4f66ade6bbd8833b6bae778158d54c1a6`	affected	< 8890bf450e0b6b283f48ac619fca5ac2f14ddd62

Linux

affected

Version	Status	Constraints
`4.8`	affected	—
`0`	unaffected	< 4.8
`5.10.251`	unaffected	≤ 5.10.*
`5.15.201`	unaffected	≤ 5.15.*
`6.1.164`	unaffected	≤ 6.1.*
`6.6.125`	unaffected	≤ 6.6.*
`6.12.72`	unaffected	≤ 6.12.*
`6.18.11`	unaffected	≤ 6.18.*
`6.19.1`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,528b2f1027edfb52af0171f0f4b227fb356dde05)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c068ebbaf52820d6bdefb9b405a1e426663c635a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7062eb0c488f35730334daad9495d9265c574853)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.125,6.7.0)`	unaffected	semver	—
`[6.12.72,6.13.0)`	unaffected	semver	—
`[6.18.11,6.19.0)`	unaffected	semver	—
`[6.19.1,6.20.0)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the corrected unload logic, which delays unloading until the fabric scan completes.
If a patch is not immediately available, configure the system to block or defer qla2xxx module unload requests while a fabric scan is active, for example by checking a status flag before attempting module removal.
Alternatively, schedule fabric scans only during maintenance windows or when module unload is not expected, to prevent overlap with unload operations.

Generated by OpenCVE AI on October 19, 2026 at 21:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4498-1	linux security update
Debian DLA	DLA-4499-1	linux-6.1 security update
Debian DSA	DSA-6141-1	linux security update
Debian DSA	DSA-6163-1	linux security update
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00109.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/528b2f1027edfb52af0171f0f4b227fb356dde05
https://git.kernel.org/stable/c/7062eb0c488f35730334daad9495d9265c574853
https://git.kernel.org/stable/c/8890bf450e0b6b283f48ac619fca5ac2f14ddd62
https://git.kernel.org/stable/c/891f9969a29e9767a453cef4811c8d2472ccab49
https://git.kernel.org/stable/c/984dc1a51bf6fc3ca4e726abe790ec38952935d8
https://git.kernel.org/stable/c/c068ebbaf52820d6bdefb9b405a1e426663c635a
https://git.kernel.org/stable/c/d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32
https://git.kernel.org/stable/c/d8af012f92eee021c6ebb7093e65813c926c336b
https://lore.kernel.org/linux-cve-announce/2026021805-CVE-2025-71235-b233@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-71235
https://www.cve.org/CVERecord?id=CVE-2025-71235

History

Mon, 19 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Thu, 11 Jun 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 18 Mar 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Mon, 23 Feb 2026 03:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/8890bf450e0b6b283f48ac619fca5ac2f14ddd62

Thu, 19 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/891f9969a29e9767a453cef4811c8d2472ccab49 https://git.kernel.org/stable/c/984dc1a51bf6fc3ca4e726abe790ec38952935d8 https://git.kernel.org/stable/c/d8af012f92eee021c6ebb7093e65813c926c336b

Thu, 19 Feb 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021805-CVE-2025-71235-b233@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-71235 https://www.cve.org/CVERecord?id=CVE-2025-71235
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 18 Feb 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Delay module unload while fabric scan in progress System crash seen during load/unload test in a loop. [105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 [105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0 [105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000 [105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000 [105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0 [105954.384928] PKRU: 55555554 [105954.384929] Call Trace: [105954.384931] <IRQ> [105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx] [105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx] [105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx] [105954.384999] ? __wake_up_common+0x80/0x190 [105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx] [105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx] [105954.385040] ? __handle_irq_event_percpu+0x3d/0x190 [105954.385044] ? handle_irq_event+0x58/0xb0 [105954.385046] ? handle_edge_irq+0x93/0x240 [105954.385050] ? __common_interrupt+0x41/0xa0 [105954.385055] ? common_interrupt+0x3e/0xa0 [105954.385060] ? asm_common_interrupt+0x22/0x40 The root cause of this was that there was a free (dma_free_attrs) in the interrupt context. There was a device discovery/fabric scan in progress. A module unload was issued which set the UNLOADING flag. As part of the discovery, after receiving an interrupt a work queue was scheduled (which involved a work to be queued). Since the UNLOADING flag is set, the work item was not allocated and the mapped memory had to be freed. The free occurred in interrupt context leading to system crash. Delay the driver unload until the fabric scan is complete to avoid the crash.
Title		scsi: qla2xxx: Delay module unload while fabric scan in progress
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/528b2f1027edfb52af0171f0f4b227fb356dde05 https://git.kernel.org/stable/c/7062eb0c488f35730334daad9495d9265c574853 https://git.kernel.org/stable/c/c068ebbaf52820d6bdefb9b405a1e426663c635a https://git.kernel.org/stable/c/d70f71d4c92bcb8b6a21ac62d4ea3e87721f4f32

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-02-18T14:53:20.222Z

Updated: 2026-10-19T18:25:24.584Z

Reserved: 2026-02-18T14:25:13.845Z

Link: CVE-2025-71235

Vulnrichment

Updated: 2026-06-11T17:37:53.911Z

NVD

Status : Modified

Published: 2026-02-18T16:22:30.293

Modified: 2026-10-19T19:17:17.510

Link: CVE-2025-71235

Redhat

Severity : Low

Publid Date: 2026-02-18T00:00:00Z

Links: CVE-2025-71235 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-19T21:15:04Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object