This vulnerability stems from a use‑after‑free in the Linux kernel’s qla2xxx SCSI driver. When the NVMe transport attempts to send a logical sector (LS) response, the function that frees the unsolicited context structure leaves that node still linked in the fcport->unsol_ctx_head list. Subsequent list operations then write through the freed node, corrupting the list and triggering a kernel panic. The resulting loss of kernel memory integrity can cause the system to crash, effectively denying service to all users.

Any Linux system that incorporates the qla2xxx SCSI driver for QLogic SCSI adapters is potentially affected. The alteration is within the kernel source and applies to any distribution that ships the upstream driver without the patch commit. No specific kernel version range is supplied, so all kernels containing the unpatched driver are at risk.

The CVSS base score of 8.8 signals high severity, yet the EPSS score of less than 1% indicates a very low probability that an adversary exploits the flaw. The non‑listing in the CISA KEV catalog suggests no widespread exploitation is currently known. The likely attack vector is local, inferred from the need to cause an LS reject error on the SCSI device; an attacker with privileged user access can invoke the error path and trigger the crash. Although no remote trigger is documented, systems exposed to untrusted administrators or with insecure device access still face a serious DoS risk.