The qla2xxx SCSI driver implements a routine called bsg_done() that, when invoked on failure paths, frees memory twice. This double free corrupts kernel memory and can trigger a catastrophic kernel panic, bringing the entire system offline. The flaw is a classic CWE‑415 (double free vulnerability) that directly compromises the integrity and availability of the operating system.

All Linux kernel releases that ship the qla2xxx SCSI driver before the fix. This includes the wide range of distributions compiling the kernel from source or providing pre‑built kernel packages (e.g., CentOS/RHEL 9, Fedora, Ubuntu). Any host that has a Qlogic SCSI adapter loaded and the qla2xxx module active is potentially affected, regardless of the specific kernel version. Because the vulnerability exists in the legacy code path, every unsynchronized kernel before the patch is at risk.

The CVSS score of 7.8 indicates a high‑severity impact, while the EPSS score of less than 1 % reflects a low probability of mass exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the vulnerable driver to be loaded and that a Qlogic SCSI device be present to interact with the firmware or send commands that trigger the fault. The attack vector is local or through malicious SCSI command streams, so untrusted users on the host or potentially remote attackers who can influence SCSI traffic would be able to trigger the double free. The consequence is an immediate system crash, denying availability to all users and services on the host.