A flaw was discovered in the Linux kernel’s qla2xxx SCSI driver where the request ring for QLAFX00 adapters was cleared with a plain memset(). On architectures such as ARM64 this can generate unaligned or block‑zeroing instructions that are illegal on device memory, causing a synchronous external abort. The outcome is a kernel fault that can crash the system, leading to denial of service. The flaw involves improper use of memory‑clear primitives on I/O memory, a typical buffer initialization weakness.

All Linux kernel builds that include the qla2xxx driver for QLA FX00 SCSI adapters are affected, regardless of vendor. The issue is present in the generic Linux kernel repository and applies to any distribution shipping the unpatched kernel. No version numbers are explicitly listed, but the patch is part of recent kernel revisions; systems running legacy kernel releases prior to the fix are at risk.

The CVSS score is 5.5, indicating a moderate severity, and the EPSS score is < 1%, with no listing in KEV. The vulnerability leads to a kernel panic rather than an attacker‑controlled payload. The risk remains that a local actor or automatic production workload interacting with the problematic SCSI adapter could trigger a crash. No known exploits exist, so exploitation requires only interaction with the device, giving the risk a moderate severity class for environments that rely on continuous availability.