Executive brief
A vulnerability in the Linux kernel's QLogic Fibre Channel driver can cause system instability or crashes during hardware reset events. The driver fails to properly clear pending commands after a chip reset, leading to resources becoming stuck or memory management errors. This could potentially be exploited to disrupt storage operations or cause a complete system failure in environments using affected QLogic storage adapters.
Technical details
A regression in the qla2xxx driver's target mode handling caused SCSI commands to remain stuck in the firmware queue after a chip reset. Additionally, a race condition existed between multiple CPUs attempting to unmap scatter-gather (SG) lists simultaneously, leading to a BUG_ON crash in dma_unmap_sg_attrs(). The vulnerability is rooted in improper state management within __qla2x00_abort_all_cmds and qlt_free_cmd. An attacker capable of triggering or influencing storage traffic that leads to adapter resets could cause a Denial of Service (DoS) or potentially other memory-related impacts. The fix involves reverting problematic commits and ensuring commands are properly unmapped and freed during the abort sequence.
Affected products
- Linux Linux Kernel 5.2 to 6.18.2
Timeline
- 2025-11-10: other: Patch authored
- 2025-12-24: disclosed: CVE published