The Linux kernel’s scsi qla2xxx driver contains a loop that waits for a signature value 0xDEADDEAD to confirm that a continuation IOCB has arrived. When the Fibre Channel frame payload contains that same byte pattern, the driver misinterprets it as the signature and spins forever in cpu_relax(), causing a soft CPU lockup in interrupt/DPC context. The flaw does not enable arbitrary code execution but stalls the CPU and aborts the Fibre Channel session, leading to a loss of service on the affected host.

The vulnerability is limited to systems that load the qla2xxx driver in the Linux kernel. No specific kernel releases are listed in the CVE entry, so any kernel that incorporates the unpatched qla2xxx code is potentially affected. Distributions that ship older kernels without the upstream patch, or users who compile the kernel themselves, must consider this risk. Precise version ranges cannot be determined from the data provided.

The CVSS base score of 5.5 indicates moderate severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation. The vulnerability is not currently in the CISA KEV catalog, so no confirmed widespread attacks are known. The likely attack vector is the injection of a Fibre Channel frame with a payload matching 0xDEADDEAD into the qla2xxx driver during interrupt context, as inferred from the code’s polling loop. An attacker would need to be able to inject a Fibre Channel frame whose payload equals 0xDEADDEAD and reach the driver in interrupt context, which may require local privileges or a compromised or misconfigured FC network. If triggered, the resulting soft lockup would halt the exposed CPU(s) and cause a denial of service for processes depending on the affected storage subsystem.