CVE-2025-71235: scsi: qla2xxx: Delay module unload while fabric scan in progress
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Delay module unload while fabric scan in progress
System crash seen during load/unload test in a loop.
[105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 [105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0 [105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000 [105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000 [105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0 [105954.384928] PKRU: 55555554 [105954.384929] Call Trace: [105954.384931] <IRQ> [105954.384934] qla24xxspunmap+0x1f3/0x2a0 [qla2xxx] [105954.384962] ? qlaasyncscanspdone+0x114/0x1f0 [qla2xxx] [105954.384980] ? qla24xxelsctentry+0x4de/0x760 [qla2xxx] [105954.384999] ? wakeupcommon+0x80/0x190 [105954.385004] ? qla24xxprocessresponsequeue+0xc2/0xaa0 [qla2xxx] [105954.385023] ? qla24xxmsixrspq+0x44/0xb0 [qla2xxx] [105954.385040] ? handleirqeventpercpu+0x3d/0x190 [105954.385044] ? handleirqevent+0x58/0xb0 [105954.385046] ? handleedgeirq+0x93/0x240 [105954.385050] ? commoninterrupt+0x41/0xa0 [105954.385055] ? commoninterrupt+0x3e/0xa0 [105954.385060] ? asmcommoninterrupt+0x22/0x40
The root cause of this was that there was a free (dmafreeattrs) in the interrupt context. There was a device discovery/fabric scan in progress. A module unload was issued which set the UNLOADING flag. As part of the discovery, after receiving an interrupt a work queue was scheduled (which involved a work to be queued). Since the UNLOADING flag is set, the work item was not allocated and the mapped memory had to be freed. The free occurred in interrupt context leading to system crash. Delay the driver unload until the fabric scan is complete to avoid the crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Delay unloading the qla2xxx driver/module until the fabric scan or device discovery has completed to avoid the crash.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71235?
CVE-2025-71235 is classified as a high-severity vulnerability due to its potential to cause system crashes during module unload operations.
How do I fix CVE-2025-71235?
To fix CVE-2025-71235, update the Linux kernel to the latest version where the vulnerability has been resolved.
What systems are affected by CVE-2025-71235?
CVE-2025-71235 affects the Linux kernel, particularly those using the qla2xxx SCSI driver.
What are the potential impacts of CVE-2025-71235?
The potential impacts of CVE-2025-71235 include system crashes during load/unload operations, which can lead to data loss or service interruptions.
Is CVE-2025-71235 being actively exploited?
As of now, there is no public evidence suggesting that CVE-2025-71235 is being actively exploited in the wild.