Executive brief
The Linux kernel's qla2xxx driver (used for Fibre Channel storage adapters) contains a race condition in firmware dump handling. A concurrent debugfs operation and firmware dump could free a memory buffer while the dump is still reading from it, causing a kernel memory access violation. This could lead to a system crash or unexpected behavior during storage diagnostics.
Technical details
The vulnerability is a use-after-free race condition in the qla2xxx driver's FCE (Fibre Channel Event) trace buffer management. The qla2x00_free_fce_trace() function freed the DMA buffer while holding only fce_mutex, but firmware dump consumers (qla27xx_fwdt_entry_t264() and qla25xx_copy_fce()) read the same buffer under hardware_lock without acquiring fce_mutex. This allowed a debugfs FCE disable operation to free the buffer between a dump's NULL pointer check and its subsequent buffer copy, resulting in use-after-free. The fix synchronizes unpublishing of the buffer under hardware_lock before releasing the DMA memory, ensuring atomic visibility across both paths. The vulnerability affects the Linux kernel's SCSI/Fibre Channel subsystem and was patched upstream by moving buffer cleanup under the hardware_lock critical section.
Affected products
- Linux Linux kernel multiple versions across the 4.x, 5.x, and 6.x release series
Timeline
- 2026-09-16: disclosed
- 2026-07-30: patched: Upstream fix committed