Executive brief
The Linux kernel's qla2xxx SCSI driver contains a flaw in its debugfs interface for controlling FCE (Fabric Connectivity Event) trace buffers. A malformed write to the debugfs file can cause a kernel panic due to a null pointer dereference, and the buggy logic inverts the intended behavior—valid numbers disable tracing while invalid input enables it. This affects systems using Qlogic SCSI adapters with kernel debugging facilities exposed.
Technical details
The vulnerability exists in qla2x00_dfs_fce_write() in drivers/scsi/qla2xxx/qla_dfs.c. The function incorrectly passes a NULL pointer as the result buffer to kstrtoul(), which would cause a null pointer dereference on successful parse. Additionally, the function assigns the integer return value (0 on success, negative errno on failure) directly to the unsigned long enable flag, inverting the logic: successful parses were treated as disable (0), while parse failures enabled FCE. The fix parses the value into a proper enable variable and properly checks the return code before proceeding. This requires debugfs access (typically limited to root or privileged users) and affects multiple Linux kernel versions via the qla2xxx driver.
Affected products
- Linux Linux kernel multiple versions; fixed in upstream stable series
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Patch merged to stable kernel branches