During adapter teardown the queue work handler schedules a work function that later dereferences a freed qpair structure, leading to a use‑after‑free condition. If an attacker can influence the data stored in the freed memory, the kernel could execute unintended code, potentially yielding local privilege escalation or arbitrary code execution. Even without direct control, the corruption may crash the system, causing a denial of service.

The vulnerability applies to Linux kernel implementations that include the qla2xxx SCSI driver prior to the patch commit referenced in the advisory. No specific kernel versions are listed, so any kernel containing the unpatched driver is potentially affected.

The CVSS score is 7.5, indicating high severity. The EPSS score is unavailable and the vulnerability is not catalogued in the CISA KEV list. Exploitation would likely require local or privileged access to the affected system and sufficient ability to influence the freed memory, limiting the attack surface to local or compromised‑administrator contexts. Consequently, the risk is moderate to high, especially for systems that rely on the qla2xxx driver for SCSI networking.