Executive brief
The Linux kernel's Qlogic qla2xxx SCSI driver contains a NULL pointer dereference in the EDIF (Encryption, Decryption, Integrity, Frame validation) security feature. When firmware posts a status completion for an already-aborted command, the driver crashes in interrupt context, causing kernel panic and system unavailability.
Technical details
A NULL pointer dereference vulnerability exists in qla_chk_edif_rx_sa_delete_pending() within the qla2xxx SCSI driver. The function obtains a SCSI command pointer via GET_CMD_SP(sp) and immediately dereferences cmd->sc_data_direction without checking for NULL. The command pointer can be NULL when firmware posts a status completion for a command already returned or aborted. While the caller qla2x00_status_entry() performs a NULL check later in the path, it executes after the vulnerable dereference, resulting in kernel crash in interrupt context. The fix adds an early return when cmd is NULL before any pointer dereference. The patch was committed as c20ee380ca59c5a8646750c4849969a815924e2e and backported to stable kernel series.
Affected products
- Linux Linux kernel Multiple versions through qla2xxx driver (fixed in c20ee380ca59c5a8646750c4849969a815924e2e and stable backports)
Timeline
- 2026-09-16: disclosed
- 2026-07-23: patched: Upstream commit c20ee380ca59c5a8646750c4849969a815924e2e
- 2026-09-14: other: Backported to stable kernel