Executive brief
A vulnerability in the Linux kernel's QLogic Fibre Channel driver could cause a system crash during specific hardware management tasks, such as CPU hotplugging. This occurs when the system attempts to process a timed-out data transfer request that has already been completed. An exploit would result in a denial-of-service (system crash), potentially disrupting business operations and data availability.
Technical details
A race condition exists in the qla2xxx SCSI driver within the Linux kernel. When an I/O abort operation times out, the `qla24xx_abort_iocb_timeout` function is triggered. This function previously attempted to call the completion routine without verifying if the I/O or the abort request were still outstanding. If the I/O had already completed, this resulted in a null pointer dereference or similar memory corruption leading to a kernel panic. The vulnerability is particularly visible during CPU hotplug events. Patches have been released for various stable kernel branches to ensure the request is still valid before attempting completion.
Affected products
- Linux Linux Kernel 5.4.4 to 5.15.86, 5.16 to 6.0.16, 6.1 to 6.1.2
Timeline
- 2022-11-29: other: Initial patch authored
- 2025-10-04: advisory: NVD Published Date
- 2022-12-31: patched: Patch committed to stable branches
References
- https://git.kernel.org/stable/c/05382ed9142cf8a8a3fb662224477eecc415778b
- https://git.kernel.org/stable/c/5f730e489e741c28fe6a5b3308e33c094462acb0
- https://git.kernel.org/stable/c/68ad83188d782b2ecef2e41ac245d27e0710fe8e
- https://git.kernel.org/stable/c/cb4dff498468b62e8c520568559b3a9007e104d7
- https://git.kernel.org/stable/c/d3871af13aa03fbbe7fbb812eaf140501229a72e