Executive brief
The Linux kernel's qla2xxx SCSI driver contains a race condition in error handling that can cause a system crash. A NULL pointer dereference occurs in the interrupt handler when the driver's queue cleanup code runs concurrently with error processing, potentially leading to a denial of service.
Technical details
The vulnerability is a use-after-check race condition in the qla2xxx SCSI driver's qla2x00_error_entry() function. The function reads the request queue pointer (ha->req_q_map[que]) twice: once for a NULL check and again to assign it to a local variable. Between these two reads, the qla25xx_free_req_que() function may set the queue pointer to NULL during queue teardown (while holding mq_lock), causing the second read to return NULL. The interrupt handler then dereferences the NULL pointer, triggering a kernel panic. The fix reads the slot once into req and performs a single NULL check on the local variable before use, eliminating the race window.
Affected products
- Linux Linux kernel Affects multiple kernel versions (qla2xxx driver) with patch available
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-07-30: patched: Fix committed upstream by Nilesh Javali